CVE-2026-114431: Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Enable Media Replace WordPress pluginto a version that resolves this vulnerability.Fixed in 4.2.3
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using a version of Enable Media Replace before 4.2.3 are exposed only if an SVG-enabling plugin is also active. Without SVG support enabled, the media replacement path rejects SVG uploads.
What does an attacker need to exploit it?
An attacker needs an authenticated account with permission to upload media and replace a media file. They must upload an SVG containing script and induce someone to open that SVG directly.
Are existing malicious SVG files a concern?
Potentially. The issue allows scripted SVG content to be stored through the replacement workflow, so administrators should review SVG files that were uploaded or used to replace media by users with upload access, particularly where their origin is untrusted.