EM
Product
Enable Media Replace
7
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 2Medium 5Low 0
Watch
Add Enable Media Replace to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-4643 | 8.8 | Oct 16 | The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection… Affected: before 4.1.3 |
| CVE-2023-0255 | 8.8 | Feb 13 | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected… Affected: before 4.0.2 |
| CVE-2026-5714 | 6.4 | Jun 9 | Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter Affected: through 4.1.8 |
| CVE-2023-6737 | 6.1 | Jan 11 | The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to… Affected: through 4.1.4 |
| CVE-2026-57722 | 5.9 | Jul 1 | WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability Affected: through 4.2.1 |
| CVE-2022-2554 | 4.9 | Oct 10 | Enable Media Replace < 4.0.0 - Admin+ Path Traversal Affected: before 4.0.0 |
| CVE-2026-85655 New | 4.3 | Oct 28 | Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow Affected: through 4.2.2 |
Showing 7