Media Cleaner: Clean your WordPress!

Media Cleaner: Clean your WordPress! has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 4.7, and the most serious one scores 5.3 out of 10.

The most common weakness is Insertion Of Sensitive Information Into Log File, behind 1 of the records (50%). Other recurring categories include Server-Side Request Forgery (SSRF).

Every one of the 2 issues recorded for Media Cleaner: Clean your WordPress! has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Media Cleaner: Clean your WordPress! is installed on roughly 90,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
4.7/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Media Cleaner: Clean your WordPress! vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2024-33922

Media Cleaner: Clean your WordPress! <= 6.7.2 - Unauthenticated Information Exposure

Read the full analysis

Vulnerability Records

2 records
Media Cleaner: Clean your WordPress! banner
Latestv7.2.7

Media Cleaner: Clean your WordPress!

Jordy Meow

Author

Jordy Meow

4.6(770)
92/100
Last Updated
2026-09-07 (6d ago)
Active Installs
90,000+
Downloads
5,038,788
Requires WP
6.0+
Requires PHP
8.1+
Tested up to
WP 7.1
Created
2016-05-15 (11y ago)

Media Cleaner is a powerful plugin that helps you clean up your WordPress media library by deleting unused media entries and files, as well as fixing broken entries. With an internal trash feature, you can preview and confirm changes before permanently deleting anything. Plus, Media Cleaner uses smart analysis to ensure compatibility with specific plugins and themes. Use it alongside Database Cleaner for the ultimate clean-up experience. Media Cleaner is like a ninja assassin for your Media Library – it’ll stealthily take out all the unnecessary media and broken entries that are cluttering up the place. Just make sure you have a solid backup plan in place before you let this bad boy loose. To learn more about compatibility, features, and the Pro version, check out the tutorial on the official website. AI ASSISTANTS (MCP) Media Cleaner can be driven by an AI assistant, through the MCP server of AI Engine. Enable MCP in the Media Cleaner settings, and your assistant (Claude, ChatGPT, and the others) is able to run a scan, read the results, explain why a media was reported, ignore the false positives, and clean up. It is not a black box: the tools tell the assistant which builders and plugins are supported on your site, which ones are not, and what the scan cannot see, so it can warn you and check the doubtful cases instead of trusting the results blindly. Deleted files still go to the trash, and a permanent deletion always requires your explicit confirmation. COMPATIBILITY This plugin is compatible with all media types, including retina and WebP versions. It has been tested on a wide range of WordPress versions, including the latest version with Gutenberg, as well as on various themes with a large community of users. It also supports WooCommerce. For users with more complex plugins for handling website content, the Pro version may be necessary for optimal compatibility. We are constantly working to increase compatibility with other plugins. PRO VERSION Media Cleaner Pro adds extra features to the free version of Media Cleaner: Filesystem Analysis: Scans your physical /uploads directory and matches it against the Media Library. Extra support for complex plugins, such as ACF, Metabox, Divi Builder, Fusion Builder (Avada), WPBakery Page Builder, Visual Composer, Elementor, Beaver Builder, Brizy Builder, Oxygen Builder, Slider Revolution, Justified Image Grid, Avia Framework, and many more! Live Site Scan: Analyzes the online version of your website, potentially improving accuracy in some cases. WP-CLI support: Allows you to run the plugin at a higher speed or automatically with direct server access (via SSH).

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C