EUVD-2026-41096
GHSA-c8m2-cj6f-v5p6
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
PR:H reflects editor-level authentication required to inject the payload; A:N applied because stored XSS does not disrupt service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS.
This issue affects Enable Media Replace: from n/a through 4.2.1.
AnalysisAI
Stored cross-site scripting in the ShortPixel Enable Media Replace WordPress plugin (all versions through 4.2.1) allows an authenticated attacker with high-level privileges to inject persistent malicious scripts via the media replacement workflow, which then execute in the browser context of any WordPress user who subsequently views the affected content. The scope change confirmed by the CVSS vector (S:C) means a compromised editor-level account could be leveraged to target administrator sessions, enabling privilege escalation within the WordPress admin interface. No public exploit code or CISA KEV listing has been identified at time of analysis; the Patchstack advisory is the primary confirmed intelligence source.
Technical ContextAI
The affected component is the ShortPixel Enable Media Replace WordPress plugin (CPE: cpe:2.3:a:shortpixel:enable_media_replace:*:*:*:*:*:*:*:*), which extends the WordPress Media Library by allowing replacement of existing media files in-place without the need to delete and re-upload. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) in its Stored XSS variant: attacker-controlled input passed through the media replacement feature is persisted to the WordPress database without adequate sanitization or output encoding, and later rendered into HTML pages without escaping. The CVSS vector's Scope:Changed metric confirms the injected script executes in the victim's browser security context rather than the server's, enabling cross-context attacks including session token theft and DOM manipulation against authenticated WordPress users who load the affected content.
RemediationAI
Update the Enable Media Replace plugin to a version released after 4.2.1 once ShortPixel publishes a patched release; monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/enable-media-replace/vulnerability/wordpress-enable-media-replace-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve for confirmation of the exact fixed version number, which is not independently confirmed in available data. As a compensating control prior to patch availability, restrict the ability to use media replacement functionality to the minimum necessary user roles and audit existing editor and contributor accounts for signs of unauthorized access or credential compromise. Disabling the Enable Media Replace plugin entirely eliminates the attack surface with the trade-off of losing in-place media replacement capability, requiring manual delete-and-reupload workflows instead. A WordPress-layer WAF such as Patchstack Shield or Wordfence with XSS ruleset enabled may partially block exploitation attempts but is not a substitute for patching.
More in Enable Media Replace
View allThe Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the si
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder
The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG p
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today