WordPress security by component

Create by Mediavine

Plugin description

Create by Mediavine creates structured recipe and project cards with formatted content, instructions, ingredients, and related metadata.

Create by Mediavine (mediavine-create) is a WordPress plugin with 9 published CVE records in this archive. The latest tracked vulnerability was published Sep 19, 2026; the highest published CVSS base score is 9.8.

Plugin slug: mediavine-create

Latest vulnerability

CVE-2026-13200: Create advanced-filter ordering input reaches SQL

An Author or higher role can inject SQL through the order parameter, but only when the advanced-filter branch is entered using linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type. Insufficient escaping and query preparation allow sensitive database information extraction. The export does not disclose the full endpoint or query function. Authoritative affected range: <= 2.5.3. Confirmed remediation: 2.5.4.

PublishedSep 19, 2026

Known safe version2.5.4

Published vulnerabilities for mediavine-create
		Safe version
Sep 19, 2026	CVE-2026-13200 Create advanced-filter ordering input reaches SQL An Author or higher role can inject SQL through the order parameter, but only when the advanced-filter branch is entered using linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type. Insufficient escaping and query preparation allow sensitive database information extraction. The export does not disclose the full endpoint or query function. Authoritative affected range: <= 2.5.3. Confirmed remediation: 2.5.4.	2.5.4	CVE6.5
Sep 19, 2026	CVE-2026-13191 Create REST ordering identifiers are vulnerable to SQL injection An Author or higher role can reach a REST endpoint whose permission callback defaults to publish_posts and supply SQL through order_by. The unescaped, unprepared value reaches a database query and can expose sensitive information. No additional advanced-filter prerequisite is stated for this CVE. The exact REST route and query function are not disclosed. Authoritative affected range: <= 2.5.3. Confirmed remediation: 2.5.4.	2.5.4	CVE6.5
Aug 09, 2026	CVE-2026-18037 Create public REST rendering route reads and publishes unpublished content Create before 2.5.4 does not authorize a request before rendering content through a public REST API route. An unauthenticated attacker can request unpublished content and the route publishes that content as a side effect, both disclosing it and changing its visibility.	2.5.4	CVE6.5
Aug 09, 2026	CVE-2026-16992 Create public REST content route reads and publishes unpublished posts Create before 2.5.4 does not authorize a request before returning content through a public REST API route. An unauthenticated attacker can request unpublished content and the route publishes that content as a side effect, both disclosing it and changing its visibility.	2.5.4	CVE6.5
Jul 23, 2026	CVE-2026-65490 Create: A security weakness Create is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.6.0.	2.6.1	CVE5.3
Jul 23, 2026	CVE-2026-24552 Create: SQL injection Create is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 2.5.3.	2.5.4	CVE8.5
Jul 21, 2024	CVE-2024-37495 Create by Mediavine: Cross-site scripting Create by Mediavine is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5
Jun 27, 2024	CVE-2024-5601 Create by Mediavine: Cross-site scripting Create by Mediavine is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4
Mar 20, 2024	CVE-2024-1711 Create by Mediavine: SQL injection Create by Mediavine is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers