Media Hygiene: Remove or Delete Unused Images and More!
Media Hygiene: Remove or Delete Unused Images and More! has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; all 3 are fixed as of October 2026. Their average CVSS score is 4.7, and the most serious one scores 5.4 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Missing Authorization, behind 3 of the records (100%).
Every one of the 3 issues recorded for Media Hygiene: Remove or Delete Unused Images and More! has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, most of them (2) reported by domiee13. Media Hygiene: Remove or Delete Unused Images and More! is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-47469Media Hygiene <= 4.0.0 - Missing Authorization
Read the full analysisVulnerability Records

Media Hygiene: Remove or Delete Unused Images and More!
Author
slui
Old logos. Images from last year’s redesign. Uploads you tried once and forgot about. A WordPress media library keeps growing long after you have stopped using some of what is in it. Media Hygiene finds the files worth a second look. Scan your library, review what appears unused, and decide what stays. Clearing out what you no longer need reclaims storage and makes every future backup smaller. It suits blogs, business sites and client work. Start small, or filter a large library down into groups you can actually work through. No coding needed. How it works Scan your library. The plugin looks for references to your images, documents, audio and video across the content sources it supports. Review the results. You get names, URLs and sizes, so you can open a file or copy its address and check for yourself. Keep what matters. Add anything you want to protect to the whitelist and it stays out of every future scan. Finish when you are ready. Move files to Trash, restore them if you change your mind, or delete them permanently. You stay in control throughout. Nothing is deleted unless you select it and confirm. An unused result means no reference was found in the places the plugin reads, which is why the review step matters. Keep a backup before you delete anything. Some use cases for website owners Unable to keep track of unused media files in the media library. Uploading the same images in different sizes to figure out optimal size and forgetting which one was actually used. Switching out an image in a post with another and can’t find it media library file. Updating the logo with a new version and don’t want the old one to be indexed by Google. Images included with purchased theme but never deleted after site was launched. After a website was redesigned or rebranded, there may a number of old images or media files no longer in use. Before migrating to a new hosting provider, cleaning up the media library may make it a smoother and faster migration process. Getting a warning from your hosting provider that you are hitting the storage limit, make your backups smaller. You have guest posts or contributors who may have left behind a number of images. Changing your product listings or discontinuing products in e-commerce sites may mean images are left unused. After trying out a theme, deactivation of theme may leave behind media files. How is it Different? Media Hygiene Pro scans the entire website using a number of different techniques. One way is to “visualize images/media in page source code” to confirm the existence of a media file even when builders/plugins/themes use specialized custom posts to display their widgets on-screen. File Types: Media Hygiene will recognize most if not all major file types stored in the WordPress media library. This includes but not limited to PDF, jpg, png, gif, mp4, mp3, csv, zip, rar, and txt files. We also cover alternative extension spelling such as jpeg. Standard Features: Dashboard – shows list of all unused media by occupied space and by type. Notifications – a summary email when new files have been uploaded since your last scan. Monthly by default, and you can change it to daily, weekly, bi-weekly or quarterly, or switch it off, in Settings. Site builder compatibility – detects media placed with Gutenberg, Elementor, Divi, Bricks, Visual Composer and OceanWP on pages and posts, plus sliders built with LayerSlider (see list below). Whitelist – keep files safe from deletion. Perfect for files linked to from off-site sources. Filtering – files by name, by year and month, and by category: images, video, audio, documents or others. Page size – show between 1 and 200 results at a time. The default is 10. Exclude file types – leave chosen extensions out of the scan in Settings. Font files and CSS are excluded already. Backup – download unused media file individually or by page. Delete – remove files individually or by page. Scan – scanning process for all media files not linked to any page/post or other theme settings. Support – only through WordPress repository. Changelog Full version history is at the bottom of this page, and also at mediahygiene.com/changelog. Compatibility Please check our website to see a complete list of compatible plugins/themes. Detected by the free version, on pages and posts: Gutenberg Elementor (builder) Bricks (builder) Divi (builder) Visual Composer (builder) OceanWP (theme) LayerSlider (slider plugin, bundled with the Enfold theme) Pro adds the same builders in templates, theme options, headers, footers and custom post types, plus WP Bakery, Beaver Builder, Avada and Flatsome, and media stored by WooCommerce, ACF, Pods, Custom Field Suite, the SEO plugins and the slider plugins. More to come… What it reads, and what it does not We would rather tell you this up front than have you find out after deleting something. The free version finds media by reading your posts and pages, including the page builders listed above, your Site Editor templates, your widgets and your site logo. Some plugins store images as an ID number rather than a link. Advanced Custom Fields, WooCommerce product galleries, Pods, Custom Field Suite, the SEO plugins and the slider plugins all work that way. The free version cannot follow those, so an image used only in one of those places can appear in your unused list while your site is still using it. It tells you when that applies to your site. If one of those plugins is holding media, the dashboard says so, with a count and the plugin name, before you delete anything. A file can also be referenced by a shortcode or a dynamic tag that builds the link when the page loads, and those cannot be counted in advance. So treat the results as a list to review rather than a verdict, and keep a backup before deleting. Pro reads all of the above. Pro Pro reads the places the free version cannot. Media stored by plugins Advanced Custom Fields, including image, gallery, file and repeater fields WooCommerce product galleries, category images, downloadable files and custom tabs Pods Custom Field Suite Jet Engine Yoast SEO, All in One SEO and SEO Press Slider Revolution, Meta Slider and Smart Slider Wider coverage of the builders The free version reads page builders on your pages and posts. Pro also reads saved templates, headers, footers, theme options and custom post types, so a template reused across the site is not mistaken for unused content. Stronger matching Pro matches resized copies, scaled, rotated and edited versions back to the original file, follows references inside JSON and serialized data, and works on sites where the uploads folder has been moved. Tools Folder Scan, which checks the uploads folder for files with no database record at all Quarantine, which moves files aside first so you can restore them if something was in use One shot download and one shot delete for the whole list rather than a page at a time Filter by year and by file type WP-CLI commands for large libraries, so a scan is not limited by browser timeouts Direct support from the plugin Coming to Pro Meta Box CPT UI Remote server backup and restore Scheduled scans, so a scan can run on a timer rather than being started by hand WPML, Weglot and TranslatePress
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C