AIKIDO-2026-10349

TL;DR

Affected versions of this package include releases that incorporated WordPress components prior to the upstream security fixes, exposing multiple vulnerabilities including Blind SSRF, stored XSS, regex-based DoS, authorization bypasses, path traversal in PclZip, and an XXE flaw in the bundled getID3 library. An attacker could exploit these issues by injecting malicious payloads into menus or directives to achieve stored XSS, crafting requests to trigger SSRF or bypass authorization checks, abusing vulnerable regex parsing to cause resource exhaustion, or leveraging path traversal/XXE to access sensitive files or internal services. Successful exploitation may allow data exfiltration, privilege escalation, remote content injection, or disruption of service depending on the affected component and deployment configuration. Immediate upgrade is recommended as these fixes were ported from upstream WordPress security patches addressing multiple independent vulnerabilities.