DigitalOcean Spaces Sync

DigitalOcean Spaces Sync has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for DigitalOcean Spaces Sync has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by Nabil Irawan. DigitalOcean Spaces Sync is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.3.23.

Strategic Overview

Avg CVSSMedium
4.4/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all DigitalOcean Spaces Sync vulnerabilities before they are exploited.

Most severe open issueCVSS 4.4CVE-2025-49047

DigitalOcean Spaces Sync <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv2.2.1

DigitalOcean Spaces Sync

keeross

Author

keeross

3.9(13)
78/100
Last Updated
2020-02-16 (7y ago)
Active Installs
500+
Downloads
27,154
Requires WP
4.6+
Requires PHP
0+
Tested up to
WP 5.3.23
Created
2017-11-23 (9y ago)

DigitalOcean Spaces Sync plugin connects your Media Library to a container in DigitalOcean Spaces. It syncs data from your website to cloud storage and replaces links to images (optional). You may keep the media locally (on your server) and make backup copy to cloud storage, or just serve it all from DigitalOcean Spaces. In order to use this plugin, you have to create a DigitalOcean Spaces API key. You may now define constants in order to configure the plugin. If the constant is defined, it overwrites the value from settings page. Contants description: – DOS_KEY – DigitalOcean Spaces key – DOS_SECRET – DigitalOcean Spaces secret, – DOS_ENDPOINT – DigitalOcean Spaces endpoint, – DOS_CONTAINER – DigitalOcean Spaces container, – DOS_STORAGE_PATH – The path to the file in the storage, will appear as a prefix, – DOS_STORAGE_FILE_ONLY – Keep files only in DigitalOcean Spaces or not, values (true|false), – DOS_STORAGE_FILE_DELETE – Remove files in DigitalOcean Spaces on delete or not, values (true|false), – DOS_FILTER – A Regex filter, – UPLOAD_URL_PATH – A full url to the files, WP Constant, – UPLOAD_PATH – A path to the local files, WP Constant There is a known issue with the built in WordPress Image Editor, it will not upload changed images. Know how to fix this, PR welcome.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C