Advisories · Technology

BuddyDev MediaPress.

Every CVE that names BuddyDev MediaPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-22519 CVE record

CVSS 6.5 Medium

WordPress MediaPress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability
- BuddyDev MediaPress
- Cross-site scripting (XSS)
Not analysed yet 8 Jan 2026
CVE-2025-14552 CVE record

CVSS 6.4 Medium

MediaPress <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
- buddydev MediaPress
- Cross-site scripting (XSS)
Not analysed yet 6 Jan 2026
CVE-2025-58608 CVE record

CVSS 7.5 High

WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability
- BuddyDev MediaPress
- File inclusion
Not analysed yet 3 Sept 2025