MEDIUM
Media Usage <= 0.0.4 Reflected Cross-Site Scripting
Published Aug 16, 2021
6.1
MEDIUMCVSS 3.1
EPSS 0.84%
Description
The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4.
Affected products
-
- Version 0.0.4StatusaffectedConstraints<=0.0.4
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Media Usage | Media Usage | n/a |
|
- ≤ 0.0.4
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Uninstall the plugin
Weaknesses (1)
References (2)
- https://plugins.trac.wordpress.org/browser/media-usage/trunk/mmu_admin.php#L91 x_refsource_MISCExploitThird Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34652 x_refsource_MISCExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/media-usage/trunk/mmu_admin.php#L91 | x_refsource_MISCExploitThird Party Advisory | |
| https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34652 | x_refsource_MISCExploitThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Wordfence
Published Aug 16, 2021
Updated May 5, 2025
Reserved Jun 10, 2021
Link CVE-2021-34652
CISA Vulnrichment
Updated May 5, 2025