Unused Media Scan & Delete Security & Risk Analysis

wordpress.org/plugins/unused-media-scanner

Scan and delete unused media

10 active installs v1.0.10 PHP 8.0+ WP 6.0+ Updated Feb 20, 2026
clean-media-librarydelete-unused-imagesmedia-scan-and-deletemedia-scannerscan-and-delete-images
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Unused Media Scan & Delete Safe to Use in 2026?

Generally Safe

Score 100/100

Unused Media Scan & Delete has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 2mo ago
Risk Assessment

The unused-media-scanner v1.0.10 plugin demonstrates a generally good security posture, with strong practices in areas like SQL query preparation and output escaping, both nearing 100% compliance. The absence of known vulnerabilities and critical taint analysis findings further contributes to this positive assessment. However, a significant concern is the presence of one unprotected AJAX handler out of three total entry points. This unprotected handler represents a direct attack vector that could be exploited if it handles user-supplied input without proper validation or authentication. While the plugin has no recorded vulnerability history, the existence of an unprotected entry point is a risk that should be addressed to maintain a robust security profile.

Key Concerns

  • Unprotected AJAX handler found
Vulnerabilities
None known

Unused Media Scan & Delete Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

Unused Media Scan & Delete Release Timeline

v1.0.10Current
v1.0.9
v1.0.8
v1.0.7
v1.0.6
v1.0.5
Code Analysis
Analyzed Apr 16, 2026

Unused Media Scan & Delete Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
3 prepared
Unescaped Output
1
78 escaped
Nonce Checks
3
Capability Checks
0
File Operations
0
External Requests
0
Bundled Libraries
0

SQL Query Safety

100% prepared3 total queries

Output Escaping

99% escaped79 total outputs
Data Flows · Security
All sanitized

Data Flow Analysis

4 flows
EMSC_media_scanner (includes/scanner/scanner-tools-functions.php:6)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

Unused Media Scan & Delete Attack Surface

Entry Points3
Unprotected1

AJAX Handlers 3

authwp_ajax_EMSC_media_scannerincludes/scanner/scanner-tools-functions.php:4
noprivwp_ajax_EMSC_media_scannerincludes/scanner/scanner-tools-functions.php:21
authwp_ajax_EMSC_media_deleteincludes/scanner/scanner-tools-functions.php:673
WordPress Hooks 3
actionadmin_menuunused-media-scanner.php:91
actionadmin_initunused-media-scanner.php:92
actioninitunused-media-scanner.php:97
Maintenance & Trust

Unused Media Scan & Delete Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedFeb 20, 2026
PHP min version8.0
Downloads2K

Community Trust

Rating0/100
Number of ratings0
Active installs10
Developer Profile

Unused Media Scan & Delete Developer Profile

1WL Agency

1 plugin · 10 total installs

94
trust score
Avg Security Score
100/100
Avg Patch Time
30 days
View full developer profile
Detection Fingerprints

How We Detect Unused Media Scan & Delete

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/unused-media-scanner/assets/style.css/wp-content/plugins/unused-media-scanner/assets/script.js
Script Paths
/wp-content/plugins/unused-media-scanner/assets/script.js
Version Parameters
unused-media-scanner/assets/style.css?ver=unused-media-scanner/assets/script.js?ver=

HTML / DOM Fingerprints

CSS Classes
nav-tab-active
Data Attributes
EMSC_media_scanner_ajax
JS Globals
EMSC_media_scanner_ajax
FAQ

Frequently Asked Questions about Unused Media Scan & Delete