CVE-2026-73186

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

CVE-2026-73186 WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

CVE-2026-73186

The Enable Media Replace plugin for WordPress versions

EUVD-2026-114294

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

WordPress Enable Media Replace plugin 4.1.4-4.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Enable Media Replace versions 4.1.4-4.2.2...

CVE-2026-114422

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-114422 Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-114422

The Enable Media Replace WordPress plugin (versions before 4.2.3 , specifically 4.1.4-4.2.2 ) is vulnerable to unauthenticated PHP Object Injection . The root cause is a failure to restrict allowed classes during the deserialization of stored metadata within the media replace-and-update-links rou...

CVE-2026-114422 Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

EUVD-2026-113743

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-73186: ShortPixel Enable Media Replace: Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

CVE-2026-85655

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level...

CVE-2026-85655 Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-111819

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level...

CVE-2026-85655

The Enable Media Replace plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 4.2.2 . The root cause is the doReplaceQuery() method, which fails to perform per-post capability checks when performing a database-wide search-and-replace of media URLs. This al...

CVE-2026-85655 Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level...

PT-2026-127897

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level...

WordPress Enable Media Replace plugin <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification vulnerability

Missing Authorization to Authenticated Author+ Post Content Modification vulnerability discovered by Duy Tran in WordPress Plugin Enable Media Replace versions = 4.2.2...

WordPress Plugin Enable Media Replace - Log File Exposure Detection

The WordPress plugin "Enable Media Replace" enable-media-replace bundles a ShortPixel-based logger that writes a plugin-specific log file into the WordPress uploads directory, typically as wp-content/uploads/EnableMediaReplace.log. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress plugin...

CVE-2026-57722

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This issue affects Enable Media Replace: from n/a through 4.2.1...