CVE-2026-15253

Name of the Vulnerable Software and Affected Versions Easy Media Replace WordPress plugin versions prior to 0.2.1

Description Insufficient sanitization and escaping of attachment titles before they are output in an HTML attribute within the media library list view allows users with the Author role or higher to perform a Cross-Site Scripting (XSS) attack. This occurs when a higher privileged user views the media library, causing the injected arbitrary web scripts to execute in their browser.

Recommendations Update the Easy Media Replace WordPress plugin to version 0.2.1 or later.