PT-2026-2196 · WordPress+1 · Mediapress+1

Zaim · Publicado 2026-01-08 · Atualizado 2026-01-09 · CVE-2026-22519

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BuddyDev MediaPress versions through 1.6.2

Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Stored Cross-site Scripting (XSS) condition. This allows for the injection of malicious scripts into web pages viewed by other users. The vulnerability affects the MediaPress plugin. No information was provided regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability allows for Stored XSS, meaning that malicious scripts are permanently stored on the target server.

Recommendations Update BuddyDev MediaPress to a version newer than 1.6.2.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-22519

Produtos afetados

Buddydev Mediapress

Mediapress

Referências · 6

• https://t.me/CVEtracker/41743 · Publicação no Telegram
• https://patchstack.com/database/wordpress/plugin/mediapress/vulnerability/wordpress-mediapress-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-22519 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009462355567288383 · Publicação no Twitter
• https://patchstack.com/database/Wordpress/Plugin/mediapress/vulnerability/wordpress-mediapress-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Nota
• https://twitter.com/VulmonFeeds/status/2009324030445117560 · Publicação no Twitter