Stored Cross-Site Scripting Vulnerability in MediaPress Plugin for WordPress

CVE-2025-14552

What is CVE-2025-14552?

The MediaPress plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability through its mpp-uploader shortcode. All versions up to and including 1.6.1 lack proper input sanitization and output escaping on attributes provided by users. This vulnerability enables authenticated attackers, starting from contributor-level access, to inject malicious web scripts into pages. Such scripts can be executed when any user accesses an affected page, potentially compromising the site's security and user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References