CVE-2026-114431
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through…
- Risk score
- 42/100
- CVSS
- 6.4 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file cont…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.2.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.4 medium
References
Original description
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
Last activity 4 Nov 2026. Patch Forecast updates every hour.