CVE-2026-32569

13th percentile - higher than 13% of all known CVEs

The WP Media folder plugin in versions up to and including 6.2.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker. Insufficient input sanitization allows injection of malicious JavaScript code.

An attacker can inject malicious scripts into site pages, potentially leading to session or credential theft. The risk increases when authenticated administrators are active on the site.

Update the WP Media folder plugin to a version newer than 6.2.2 once a fix is available. Until then, consider disabling the plugin or deploying WAF rules that filter XSS.