Enable Media Replace CVE-2025-9496

Requires an authenticated account with contributor-level capability or above (PR:L) on the target WordPress site running Enable Media Replace ≤4.1.6, and the ability to use the plugin's file_modified shortcode, whose user-supplied attributes are insufficiently sanitized/escaped. Exploitation is further limited by the need for a victim (admin or other user) to subsequently view the page containing the injected shortcode for the stored script to execute; sites that do not grant untrusted users contributor access are not realistically exposed.

This is a moderate-risk, authenticated Stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) rather than a top-tier emergency. The network vector and low attack complexity are offset by the PR:L requirement - the attacker must already hold a contributor-level (or higher) WordPress account, which meaningfully narrows the threat population to users who can author content. The scope change (S:C) and low confidentiality/integrity impacts reflect that injected script executes in other users' browser sessions (e.g. admins/visitors viewing the page), the classic stored-XSS blast radius. Exploitation signals are low and consistent: EPSS is 0.24% (14th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced - no public exploit identified at time of analysis. None of the signals conflict; they jointly indicate a real-but-non-urgent issue that should be patched on a normal cycle, prioritized higher only on multi-author/membership sites where untrusted users hold contributor accounts.

An attacker who has registered or obtained a contributor-level account on a WordPress site embeds the Enable Media Replace file_modified shortcode with a malicious attribute value containing JavaScript. When an administrator or other user later views the page containing that shortcode, the unsanitized attribute renders and the script executes in their authenticated session. No public exploit code is referenced; exploitation requires the low-complexity, remote-but-authenticated access described by the CVSS vector.