Enable Media Replace vulnerabilities
We track 2 vulnerabilities in Enable Media Replace products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest Enable Media Replace vulnerabilities
- 7.5 High severity
Enable Media Replace: Deserialization of Untrusted Data
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a
- 8.8 High severity
Enable Media Replace: Unrestricted Upload of File with Dangerous Type
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.