CVE-2026-114431 Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload

Description

The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.

Exploitable remotely over the network, with an administrator account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector

Network

Attack complexity

High

Privileges required

High

Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products and versions