CVE-2026-15253

Deferred Deferred - Pending Action

Stored Cross-Site Scripting in Easy Media Replace WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-15253

EUVD

EUVD-2026-62268

Affected Vendors & Products

Vendor	Product	Version / Range
easy_media_replace	easy_media_replace	to 0.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Easy Media Replace WordPress plugin version 0.2.0 or below. It occurs because the plugin does not properly sanitize and escape an attachment title before displaying it in an HTML attribute within the media library list view.

Detection Guidance

Check for the presence of the Easy Media Replace plugin version 0.2.0 or below. Inspect the media library list view for any unusual scripts in attachment titles. Review user roles with Author access or higher for suspicious activity.

Impact Analysis

Users with the Author role or higher can inject malicious scripts that execute in the browser of a higher-privileged user who views the media library. This could lead to unauthorized actions, data theft, or session hijacking for users with elevated permissions.

Compliance Impact

This vulnerability could compromise user data confidentiality and integrity, potentially violating GDPR (data protection) and HIPAA (health data privacy) requirements. Unauthorized script execution may lead to data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Disable the Easy Media Replace plugin immediately if installed. Remove or restrict Author role users' access to media library functions. Monitor for unauthorized script injections in attachment titles.

Hi! I’m here to help you understand CVE-2026-15253. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70