What is the CVSS score of CVE-2026-5714?

CVE-2026-5714 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Enable Media Replace CVE-2026-5714

EUVD-2026-35293 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 security@wordfence.com

GHSA-p8qg-vv8c-8jmw

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 03:33 vuln.today

CVE Published

Jun 09, 2026 - 03:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘location_dir’ parameter in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Enable Media Replace WordPress plugin (all versions through 4.1.8) allows authenticated attackers with Author-level access or higher to inject persistent malicious scripts via the unsanitized 'location_dir' parameter. The injected payload executes in the browser of any user who accesses an affected page, with scope changed (S:C) indicating cross-boundary impact - most critically, a low-privileged Author can compromise higher-privileged sessions including administrators. No public exploit identified at time of analysis, and no CISA KEV listing, but the low attack complexity and broad WordPress install base elevate practical risk.

Technical ContextAI

The vulnerability resides in two files of the Enable Media Replace WordPress plugin: UploadViewController.php (line 108) and screen.php (line 228), as identified by Wordfence and confirmed via the WordPress plugin repository browser at the 4.1.8 tag. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - the 'location_dir' parameter accepted during media replacement operations is neither sanitized on input nor properly escaped on output before being rendered in HTML. WordPress's media replacement workflow allows authors to substitute existing media files, and this parameter likely controls the upload directory path displayed or stored in the UI, making it a vector for persistent script injection into plugin-rendered views.

RemediationAI

No vendor-released patch version was identified in the available data at time of analysis - the only code references point to the vulnerable 4.1.8 tag, not a fixed release. Site administrators should monitor the WordPress.org plugin page and the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/c6e8a78b-01ad-47b2-84e6-4f6ff78c02b6 for an updated release. As an immediate compensating control, restrict the Author role's access to media replacement functionality if the plugin supports capability gating, or temporarily deactivate Enable Media Replace on sites where untrusted Author-level accounts are present. Implementing a Content Security Policy (CSP) header to block inline script execution will reduce XSS impact but requires careful tuning to avoid breaking legitimate WordPress functionality. Applying a Web Application Firewall rule to sanitize the location_dir parameter on input is a viable interim mitigation with low breakage risk.