Export Media URLs

Export Media URLs has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for Export Media URLs has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Skalucy. Export Media URLs is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.2/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Export Media URLs vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.1CVE-2025-68037

Export Media URLs <= 2.2 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records
Export Media URLs banner
Latestv3.2

Export Media URLs

Atlas Gondal

Author

Atlas Gondal

5.0(29)
100/100
Last Updated
2026-08-16 (28d ago)
Active Installs
7,000+
Downloads
62,999
Requires WP
3.6+
Requires PHP
5.4+
Tested up to
WP 7.1
Created
2020-07-17 (6y ago)

The fastest way to pull a complete inventory of your WordPress Media Library. Export every attachment’s details — pick exactly the columns you want from grouped, collapsible field sections with quick-select presets — then download a CSV or JSON file, or display the results in a paginated table right inside the dashboard. A separate Media Tools tab helps you audit and clean up the library. Invaluable for migrations, SEO and accessibility audits, and library cleanup. The export is built to survive real-world content: every record stays on a single CSV line even when your captions contain line breaks, commas and quotes are escaped to the CSV standard, the delimiter is switchable for Excel in European locales, and text that was mangled by an old character set (“’” instead of “’”) can be repaired on the way out. Media Tools Each tool lives on its own sub-tab and processes the library in pages (100, 250, 500, 1000 or All per page), so the scans stay fast and light even on libraries with thousands of items. Storage summary — attachment counts per media type, read straight from the database (instant) Missing file detector — find attachments whose file is gone from disk (e.g. after a bad migration) Duplicate detection — find files that are byte-for-byte identical (matched by size and content hash; choose “All” for a complete cross-library scan) Heavy image flags — spot oversized images (large file size or pixel dimensions) that slow your pages Bulk alt-text editing — review and update alt text image by image, page by page, with missing alt text highlighted You can export each media item’s: ID Title File Name URL File Size MIME Type Dimensions (width x height) Thumbnail / Medium / Large image URLs Caption Alt Text Alt Missing (flag — quickly find images with no alt text) Description Uploaded To (Parent) and Uploaded To URL — where the file was first uploaded Used In (count), Used In (posts), Used In (URLs), Used In (post ID) and Used In (post type) — every post that actually references the item Unused (flag — items not found in any post’s content) Date Uploaded The data can be filtered by media type (images, video, audio, documents, archives), by attachment status (attached vs. unattached/orphaned), by author, and between a date range before extraction. You can also export a specific item range to keep each request small on very large libraries. When do we need this plugin? To check all Media URLs of your website During a migration (and to confirm everything moved across) During an SEO or accessibility audit (find images missing alt text) To clean up orphaned media imported by a theme demo During a security audit Customizable Features Choose exactly which columns to export, grouped with quick-select presets (Migration, SEO/Accessibility, Cleanup, Full) Download as CSV or JSON, or display the results in a paginated table Filter by media type, attachment status, author and date range Export a specific item range (helpful on very large libraries) Custom or randomly generated download file name Choose the CSV delimiter (comma, semicolon or tab) and keep every record on a single line Repair mis-encoded characters and decode HTML entities on the way out, optionally folding typographic punctuation to plain ASCII Report usage as one row per media item or one row per usage, and optionally scan custom fields and page-builder data Remembers your last field selection CSV and JSON downloads stream straight to the browser, leaving nothing behind in wp-content/uploads System requirements PHP version 5.4 or higher WordPress version 3.6 or higher Feedback If you like this plugin, then please consider leaving us a good rating. Contact For further information please send me an email.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C