Log in Start free

WP Media

Products

ProductCVEsExploitedLatest
BackWPup – WordPress Backup & Restore Plugin6–Apr 14, 2026
WP Rocket4–Oct 9, 2026
Adminimize1–May 27, 2026
BackWPup1–Jul 27, 2026
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes1–Oct 10, 2026
Rocket Lazy Load1–Oct 7, 2026

Exploited and recent CVEs

  • CVE-2026-100196 High 7.2 LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content 0.3%
  • CVE-2026-97075 Medium 6.5 WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability 0.2%
  • CVE-2026-97076 High 7.5 WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability 0.3%
  • CVE-2026-105884 Medium 6.5 WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-5934 High 7.2 WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint 0.3%
  • CVE-2026-65443 High 7.1 WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-49045 Medium 4.3 WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability 0.2%
  • CVE-2026-6227 High 7.2 BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter 1.3%
  • CVE-2026-28044 Medium 5.9 WordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2025-15041 High 7.2 BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update 0.4%
  • CVE-2025-10579 Medium 5.3 BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure 0.3%
  • CVE-2023-5505 Medium 6.8 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal 1.0%
  • CVE-2023-5775 Low 2.2 BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password 0.4%
  • CVE-2023-5504 High 8.7 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal 0.9%