Enable Media Replace

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Enable Media Replace

Information

Software Type Plugin
Software Slug enable-media-replace (view on wordpress.org)
Software Status Active
Software Author shortpixel
Software Website shortpixel.com
Software Downloads 13,935,141
Software Active Installs 600,000
Software Record Last Updated July 15, 2026

9 Vulnerabilities

Submit a Vulnerability
Enable Media Replace <= 4.2.1 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
CVE-2026-57722
Jul 1, 2026
Researcher: Ananda Dhakal
Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
6.4
CVE-2026-5714
Jun 8, 2026
Researcher: tjoffe
Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
5.4
CVE-2026-2732
Mar 3, 2026
Researcher: Or Benit
Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode
6.4
CVE-2025-9496
Oct 10, 2025
Researcher: Muhammad Yudha - DJ
Enable Media Replace <= 4.1.5 - Reflected Cross-Site Scripting
6.1
CVE-2025-31081
Apr 1, 2025
Researcher: João Pedro Soares de Alcântara
Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting
4.7
CVE-2023-6737
Dec 18, 2023
Researcher: Nex Team
Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection
6.6
CVE-2023-4643
Sep 14, 2023
Researcher: Jonatas Souza Villa Flor
Enable Media Replace <= 4.0.1 - Authenticated (Author+) Arbitrary File Upload
8.8
CVE-2023-0255
Jan 17, 2023
Researcher: dc11
Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal
6.8
CVE-2022-2554
Sep 14, 2022
Researcher: Raad Haddad
Title Status CVE ID CVSS Researchers Date
Enable Media Replace <= 4.2.1 - Authenticated (Editor+) Stored Cross-Site Scripting Patched CVE-2026-57722 4.4 Ananda Dhakal July 1, 2026
Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter Patched CVE-2026-5714 6.4 tjoffe June 8, 2026
Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace Patched CVE-2026-2732 5.4 Or Benit March 3, 2026
Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode Patched CVE-2025-9496 6.4 Muhammad Yudha - DJ October 10, 2025
Enable Media Replace <= 4.1.5 - Reflected Cross-Site Scripting Patched CVE-2025-31081 6.1 João Pedro Soares de Alcântara April 1, 2025
Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting Patched CVE-2023-6737 4.7 Nex Team December 18, 2023
Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection Patched CVE-2023-4643 6.6 Jonatas Souza Villa Flor September 14, 2023
Enable Media Replace <= 4.0.1 - Authenticated (Author+) Arbitrary File Upload Patched CVE-2023-0255 8.8 dc11 January 17, 2023
Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal Patched CVE-2022-2554 6.8 Raad Haddad September 14, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation