CVE-2021-24311: External Media Project External Media

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.

Affected products

• External Media Project External Media: before 1.0.34 (fixed in 1.0.34)

Published 2021-06-01. Last modified 2026-06-17.