Bipul Jaiswal

**Name of the Vulnerable Software and Affected Versions** The Real Media Library WordPress plugin versions prior to 4.18.29 **Description** The issue allows users with the role of author and above to perform Stored Cross-Site Scripting attacks due to the plugin not sanitising and escaping the created folder names. **Recommendations** For versions prior to 4.18.29, update to version 4.18.29 or later to resolve the issue. As a temporary workaround, consider restricting the ability to create folders to higher roles until the update is applied.