CVE-2026-5714

Name of the Vulnerable Software and Affected Versions Enable Media Replace versions prior to 4.1.9

Description Insufficient input sanitization and output escaping in the Enable Media Replace plugin for WordPress allow authenticated attackers with Author-level access or higher to perform Stored Cross-Site Scripting. This is achieved via the location dir parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update to a version newer than 4.1.8. As a temporary workaround, restrict access to the location dir parameter to minimize the risk of exploitation.