CVE-2026-114431
Received Received - Intake

Stored XSS in Enable Media Replace WordPress Plugin

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WPScan

Description
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-114431
EUVD
EUVD-2026-116724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Enable Media Replace 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Enable Media Replace WordPress plugin before version 4.2.3. It occurs because the plugin does not process replaced media files through WordPress's standard upload pipeline, bypassing security checks like SVG sanitization. This allows an authenticated user with upload access to upload an SVG file containing malicious scripts that execute when the file is opened directly.

Detection Guidance

Check if the Enable Media Replace WordPress plugin version is below 4.2.3. Inspect SVG files uploaded via the plugin for embedded scripts. Review server logs for unusual SVG file access patterns.

Impact Analysis

An attacker with upload privileges could upload a malicious SVG file that executes scripts when accessed. This could lead to unauthorized actions on behalf of the user, data theft, or defacement of the website. The impact depends on the user's privileges and the site's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Organizations must ensure proper security controls to prevent such vulnerabilities from being exploited.

Mitigation Strategies

Update the Enable Media Replace plugin to version 4.2.3 or later. Disable SVG uploads if not required. Implement additional server-side validation for SVG files. Monitor for unauthorized SVG file uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...