CVE-2026-114431

The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to...

CVE-2026-114431 Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload

The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to...

CVE-2026-114431

The Enable Media Replace WordPress plugin, in versions before 4.2.3 , is vulnerable to Stored Cross-Site Scripting (XSS) via SVG uploads. The root cause is that the plugin fails to pass replaced media files through the standard WordPress upload pipeline, causing the SVG-sanitizer prefilter to be ...

EUVD-2026-116724

The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to...

WordPress Enable Media Replace plugin < 4.2.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Adam Kahlon in WordPress Plugin Enable Media Replace versions 4.2.3...

CVE-2026-15253

CVE-2026-15253 Easy Media Replace = 0.2.0 - Authenticated Author+ Stored Cross-Site Scripting Description The Easy Media Replace plugin is vulnerable to a Stored Cross-Site Scripting XSS via the media attachment title. When an Author renames a media file using an XSS payload and an Admin or Edito...

CVE-2026-73186

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

CVE-2026-73186 WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

CVE-2026-73186

The Enable Media Replace plugin for WordPress versions

WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Enable Media Replace versions = 4.2.2...

WordPress Enable Media Replace plugin 4.1.4-4.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Enable Media Replace versions 4.1.4-4.2.2...

CVE-2026-114422

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-114422 Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

EUVD-2026-113743

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-114422

The Enable Media Replace WordPress plugin (versions before 4.2.3 , specifically 4.1.4-4.2.2 ) is vulnerable to unauthenticated PHP Object Injection . The root cause is a failure to restrict allowed classes during the deserialization of stored metadata within the media replace-and-update-links rou...

CVE-2026-114422 Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-73186: ShortPixel Enable Media Replace: Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.

Subscriber PHP Object Injection in Enable Media Replace = 4.2.2 versions...

CVE-2026-114422: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

PT-2026-133283

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-85655

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level...