---
id: CVE-2026-114431
title: Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
summary: >-
  The Enable Media Replace WordPress plugin before 4.2.3 does not pass a
  replaced media file through the WordPress upload pipeline, so the upload
  prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before
  4.2.3 rely on never…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: Enable Media Replace
affected:
  - enable_media_replace < 4.2.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-04T14:04:58.301727Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:21.299Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114431'
references:
  - url: 'https://wpscan.com/vulnerability/3633f2fd-c61c-4da9-962e-8f55c8fafb3b/'
tags:
  - cve.org
epss: 0.00241
epssPercentile: 0.15318
ingestedAt: '2026-11-05T21:36:00.366Z'
---

## Overview

The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.

## Affected

- `enable_media_replace < 4.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.