CVE-2021-34652 MEDIUM

CVE-2021-34652: Media Usage <= 0.0.4 Reflected Cross-Site Scripting

Vendor Media Usage

Product Media Usage

Weakness CWE-79 · XSS

Published August 16, 2021

Last update May 5, 2025

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The Media Usage WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/mmu_admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.4.

Key dates

02Disclosure timeline

August 16, 2021 CVE published

May 5, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-34652 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-2635 Digital License Manager <= 1.7.3 - Reflected Cross-Site Scripting via remove_query_arg Function CVE-2025-47654 WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-2302 Contact Form and Calls To Action by vcita <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-6452 CVE-2022-1932 Rezgo Online Booking < 4.1.8 - Reflected Cross-Site-Scripting