Wp Media Category Management
Approved changes feed: RSS · Atom
cpe:2.3:a:de-baat:wp_media_category_management:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | De Baat (d5e16470-54d3-56dc-b7b2-b781692d4ec7) |
|---|---|
| Product | Wp Media Category Management (a5a8fe79-28cd-549e-86fe-2e3c51b8ade3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/common-repository/wp-media-category-management |
purl2cpe | 2026-07-28 16:40:57.248683 |
pkg:github/wp-plugins/wp-media-category-management |
purl2cpe | 2026-06-01 10:13:02.395650 |
pkg:github/wpplugins/wp-media-category-management |
purl2cpe | 2026-06-01 10:13:02.395654 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-0865 |
vulnerable | 2026-06-08 07:02:25.727382 |
WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update
MEDIUM (6.5)
The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wp_mcm_handle_action_settings() function. This makes it possible for unauthenticated attackers to alter plugin settings, such as the taxonomy used for media, the base slug for media categories, and the default media category via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2025-02-19T07:32:05.707Z
Updated: 2025-02-19T21:18:21.055Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.