CVE-2025-9496
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
The organization may experience malicious script execution in users' browsers, potentially leading to data theft, session hijacking, or other attacks.
Recommendation
It is recommended to update the Enable Media Replace plugin to the latest patched version and restrict user privileges to the minimum necessary.
Other vulnerabilities in Enable Media Replace
See all- CVE-2026-73186High
The Enable Media Replace WordPress plugin in versions up to 4.2.2 contains a subscriber-level PHP Object Injection vulnerability.
- CVE-2026-85655Medium
The Enable Media Replace plugin for WordPress in all versions up to and including 4.2.2 is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing authenticated attackers with author-level access and above to modify the post_content of any published post referencing the replaced media, including Administrator-owned posts. The doReplaceQuery() method performs a database-wide search-and-replace without per-post capability checks.
- CVE-2026-57722Medium
The Enable Media Replace WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from n/a through 4.2.1.
Original NVD description (English source)
The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS