PT-2026-2196 · WordPress+1 · Mediapress+1

Zaim · Published 2026-01-08 · Updated 2026-01-09 · CVE-2026-22519

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BuddyDev MediaPress versions through 1.6.2

Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Stored Cross-site Scripting (XSS) condition. This allows for the injection of malicious scripts into web pages viewed by other users. The vulnerability affects the MediaPress plugin. No information was provided regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability allows for Stored XSS, meaning that malicious scripts are permanently stored on the target server.

Recommendations Update BuddyDev MediaPress to a version newer than 1.6.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22519

Affected Products

Buddydev Mediapress

Mediapress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-22519 · Security Note
• https://t.me/CVEtracker/41743 · Telegram Post
• https://patchstack.com/database/wordpress/plugin/mediapress/vulnerability/wordpress-mediapress-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2009462355567288383 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/mediapress/vulnerability/wordpress-mediapress-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/2009324030445117560 · Twitter Post