Enable Media Replace vulnerabilities

The Enable Media Replace WordPress plugin in versions up to 4.2.2 contains a subscriber-level PHP Object Injection vulnerability.

The Enable Media Replace plugin for WordPress in all versions up to and including 4.2.2 is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing authenticated attackers with author-level access and above to modify the post_content of any published post referencing the replaced media, including Administrator-owned posts. The doReplaceQuery() method performs a database-wide search-and-replace without per-post capability checks.

The Enable Media Replace WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from n/a through 4.2.1.

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.