WP Media Categories
WP Media Categories has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for WP Media Categories has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nabil Irawan. WP Media Categories is installed on roughly 800 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.4.21.
CVE-2025-60134WP Media Categories <= 2.1.0 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
WP Media Categories
Author
John James Jacoby
Add categories to media & attachments. Main Features Control media categories the same way as post categories. Filter the Media Library by category, in both the list and grid views. Also checkout WP Chosen WP Term Order WP Term Authors WP Term Colors WP Term Icons WP Term Visibility WP User Groups WP User Activity WP User Avatars WP User Profiles WP User Signups
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C