CVE-2026-32569: WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

Q: Does exploiting this issue require an account or elevated permissions?

No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or plugin privileges.

Q: What attacker interaction is required?

The CVSS vector includes UI:R, meaning exploitation requires a user to interact with attacker-supplied content or a crafted request.

Q: Which installations should be treated as affected?

WP Media folder versions 6.2.2 and earlier are identified as affected. The provided information does not state whether any specific configuration or feature must be enabled.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

Affected Software

1 affected component

JoomUnited WP Media folder<=6.2.2

Event History

Oct 6, 2026

CVE Published

via MITRE·08:33 AM

Data Sourced

via MITRE·08:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploiting this issue require an account or elevated permissions?

No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or plugin privileges.

What attacker interaction is required?

The CVSS vector includes UI:R, meaning exploitation requires a user to interact with attacker-supplied content or a crafted request.

Which installations should be treated as affected?