DigitalOcean Spaces Sync
DigitalOcean Spaces Sync has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for DigitalOcean Spaces Sync has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nabil Irawan. DigitalOcean Spaces Sync is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.3.23.
CVE-2025-49047DigitalOcean Spaces Sync <= 2.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
DigitalOcean Spaces Sync
Author
keeross
DigitalOcean Spaces Sync plugin connects your Media Library to a container in DigitalOcean Spaces. It syncs data from your website to cloud storage and replaces links to images (optional). You may keep the media locally (on your server) and make backup copy to cloud storage, or just serve it all from DigitalOcean Spaces. In order to use this plugin, you have to create a DigitalOcean Spaces API key. You may now define constants in order to configure the plugin. If the constant is defined, it overwrites the value from settings page. Contants description: – DOS_KEY – DigitalOcean Spaces key – DOS_SECRET – DigitalOcean Spaces secret, – DOS_ENDPOINT – DigitalOcean Spaces endpoint, – DOS_CONTAINER – DigitalOcean Spaces container, – DOS_STORAGE_PATH – The path to the file in the storage, will appear as a prefix, – DOS_STORAGE_FILE_ONLY – Keep files only in DigitalOcean Spaces or not, values (true|false), – DOS_STORAGE_FILE_DELETE – Remove files in DigitalOcean Spaces on delete or not, values (true|false), – DOS_FILTER – A Regex filter, – UPLOAD_URL_PATH – A full url to the files, WP Constant, – UPLOAD_PATH – A path to the local files, WP Constant There is a known issue with the built in WordPress Image Editor, it will not upload changed images. Know how to fix this, PR welcome.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C