8.8
High
CVE-2023-4643 The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature,…
Description
The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Enable Media Replace 4.1 | earliest → < 4.1.3 | 4.1.3 |
Other CVEs of Enable Media Replace
The 5 CVEs of Enable Media Replace →
CVE-2026-114431
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
6.4
Medium
CVE-2026-114422
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…
7.5
High
CVE-2023-0255
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the…
8.8
High
CVE-2022-2554
The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload…
Not rated