Enable Media Replace EUVD-2026-41096

Exploitation requires an authenticated WordPress session with at minimum the capability to use the Enable Media Replace plugin's media replacement feature, corresponding to Editor role or higher in a default WordPress configuration (consistent with PR:H in the CVSS vector). After the attacker injects the stored payload, a separate victim user - typically one with Administrator role to be a high-value target - must load the affected content in their browser, triggering script execution (UI:R per CVSS vector). This limits exploitation to multi-user WordPress deployments where contributor, editor, or other intermediate-privilege accounts coexist alongside administrator accounts. Single-administrator sites where the same person who could inject the payload is also the only user are not meaningfully at risk. No special server configuration, non-default plugin settings, or additional features beyond the Enable Media Replace plugin being installed and active are required to trigger the vulnerability.

The NVD CVSS 3.1 score of 5.9 (Medium) accurately reflects a bounded but real threat. The network attack vector (AV:N) and low complexity (AC:L) indicate the exploit is technically straightforward once prerequisites are met, but the requirement for high privileges (PR:H) and victim user interaction (UI:R) substantially constrains the realistic attack surface. An attacker must first compromise or possess editor-level or higher WordPress credentials before the vulnerability is reachable. The scope change (S:C) is the most significant real-world risk amplifier: a lower-privileged compromised account could use this flaw to target an administrator's session, effectively enabling privilege escalation within the CMS. No EPSS score, KEV status, or POC code is provided in available intelligence, making quantitative exploitation probability assessment impossible; the absence of KEV listing suggests no confirmed widespread active exploitation as of analysis date. This should be treated as a moderate priority for multi-contributor WordPress installations and a lower priority for single-administrator sites.

An attacker who has obtained WordPress editor-level credentials through phishing or credential stuffing accesses the Media Library, selects an existing media item, and uses the Replace Media feature to inject a malicious JavaScript payload into an input field that is stored without sanitization. When a site administrator later navigates to the WordPress dashboard or a page that renders the affected media metadata, the stored script executes silently in the admin's browser, potentially exfiltrating the session cookie or issuing authenticated admin API requests on the attacker's behalf.