CVE-2026-114431

The Enable Media Replace WordPress plugin versions prior to 4.2.3 is vulnerable to a stored cross-site scripting (XSS) flaw. The plugin fails to pass replaced media files through the standard WordPress upload pipeline, causing the SVG-sanitizer prefilter to be bypassed. This allows an authenticat...