CVE-2026-32569: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Joomunited WP Media folder

This vulnerability (CVE-2026-32569) is an instance of CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). It affects the WP Media folder plugin by Joomunited, allowing unauthenticated attackers to inject malicious scripts into web pages generated by the plugin. The vulnerability exists in versions up to 6.2.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No vendor patch or mitigation details are provided in the input data.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity impact with a broad attack surface due to no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is available, consider restricting access or disabling the affected plugin if possible to reduce exposure.