WordPress security by component
rtMedia for WordPress, BuddyPress and bbPress
Plugin description
rtMedia for WordPress, BuddyPress and bbPress is a WordPress component with 6 published CVE records in this archive. The latest tracked vulnerability was published Jul 27, 2026; the highest CVE/CNA score is 9.3.
Plugin slug:
buddypress-mediaLatest vulnerability
CVE-2026-59551: rtMedia subscriber input permits SQL injection
rtMedia through 4.7.10 lets a Subscriber supply attacker-controlled input that reaches an SQL statement without safe parameterization. The attacker can interact with the WordPress database and potentially read or alter data available to the database user. The Patchstack CNA record does not disclose the endpoint, action, parameter, query or vulnerable function.
| Safe version |
|
||
|---|---|---|---|
| Jul 27, 2026 |
CVE-2026-59551
rtMedia subscriber input permits SQL injection
rtMedia through 4.7.10 lets a Subscriber supply attacker-controlled input that reaches an SQL statement without safe parameterization. The attacker can interact with the WordPress database and potentially read or alter data available to the database user. The Patchstack CNA record does not disclose the endpoint, action, parameter, query or vulnerable function.
|
4.7.11 |
CVE8.5
NVDPending
|
| Jul 27, 2026 |
CVE-2026-59549
rtMedia permits unauthenticated SQL injection
rtMedia through 4.7.10 lets an unauthenticated attacker supply input that reaches an SQL statement without safe parameterization. Exploitation can interact with the WordPress database and potentially read or alter data available to the database user. The Patchstack CNA record does not disclose the endpoint, action, parameter, query or vulnerable function.
|
4.7.11 |
CVE9.3
NVDPending
|
| Jun 15, 2026 |
CVE-2026-40773
rtMedia for WordPress, BuddyPress and bbPress: A security weakness
rtMedia for WordPress, BuddyPress and bbPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 4.7.9.
|
4.7.10 |
CVE6.5
NVDPending
|
| Feb 19, 2026 |
CVE-2026-25325
rtMedia for WordPress, BuddyPress and bbPress: A security weakness
rtMedia for WordPress, BuddyPress and bbPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 13, 2025 |
CVE-2025-9218
rtMedia for WordPress, BuddyPress and bbPress: Sensitive information exposure
rtMedia for WordPress, BuddyPress and bbPress is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE3.7
NVDPending
|
| Dec 13, 2024 |
CVE-2023-41951
rtMedia for WordPress, BuddyPress and bbPress: A security weakness
rtMedia for WordPress, BuddyPress and bbPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|