CVE-2025-52786

The vulnerability is a reflected cross-site scripting (XSS) in the WordPress Media Folder plugin, versions <=1.0.0. The plugin fails to properly sanitize input before including it in output, enabling arbitrary script injection [1].

An attacker can craft a malicious URL or form that, when visited by an authenticated administrator or other privileged user, executes JavaScript in the victim's session. User interaction is required, as the victim must click the link or visit the crafted page [1].

Successful exploitation could allow an attacker to perform actions on behalf of the victim, such as creating rogue admin accounts, installing backdoors, or redirecting visitors to malicious sites. The vulnerability has been flagged as likely to be used in mass-exploit campaigns [1].

As of the initial disclosure, no official patch is available. However, Patchstack has issued a virtual patch rule for its customers. Users are advised to update the plugin to a patched version when available or implement the virtual patch [1].