Enable Media Replace vulnerabilities

2 known vulnerabilities in Enable Media Replace from Enable Media Replace. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Enable Media Replace: Deserialization of Untrusted Data

  CVE-2026-114422Oct 30, 2026Enable Media Replace

  The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a

• 8.8 High severity

  Enable Media Replace: Unrestricted Upload of File with Dangerous Type

  CVE-2023-0255Feb 13, 2023Enable Media ReplaceEPSS 1.1%

  The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.