Login Request a demo
EM
Product
Enable Media Replace
by shortpixel · last CVE Oct 28, 2026
7
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 0High 2Medium 5Low 0
Severity
All severities7Critical0High2Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Enable Media Replace to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-5714
6.4
0%
Jun 9
Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
Affected: through 4.1.8
CVE-2023-6737
6.1
0%
Jan 11
The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to…
Affected: through 4.1.4
CVE-2026-57722
5.9
0%
Jul 1
WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability
Affected: through 4.2.1
CVE-2022-2554
4.9
1%
Oct 10
Enable Media Replace < 4.0.0 - Admin+ Path Traversal
Affected: before 4.0.0
CVE-2026-85655
New
4.3–Oct 28
Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
Affected: through 4.2.2
Showing 5