The Enable Media Replace plugin for WordPress contains a stored cross‑site scripting vulnerability in the file_modified shortcode. The shortcode’s attributes are not sanitized or escaped, which allows an attacker who is authenticated with contributor-level permissions or higher to insert arbitrary JavaScript into posts or pages. When a page containing the malicious shortcode is viewed, the injected script executes in the context of the browsed page.

Shortpixel’s Enable Media Replace plugin, any WordPress site that has the plugin installed up to and including version 4.1.6, is vulnerable. An authenticated user with a contributor role or greater can exploit the flaw by editing or creating content that contains the file_modified shortcode.

CVE‑2025‑9496 has a CVSS base score of 6.4, indicating a moderate severity. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only contributor‑level authentication, a role commonly granted to many site users, and the malicious payload is stored permanently in the content until removed. When another user views the affected page, the injected JavaScript runs in the victim’s browser.