The Easy Media Replace plugin for WordPress does not escape characters entered in an attachment title before displaying them in the media library list view. This omission allows a user with the Author role or higher to embed arbitrary JavaScript code in the title field. When a higher‑privileged user subsequently opens the media library, the stored script runs within that user's browser context. The vulnerability is a classic stored XSS that exploits improper output encoding (CWE‑79).

WordPress sites that have installed Easy Media Replace version 0.2.0 or earlier and allow authors or administrators to create or edit attachment titles are affected. The issue exists only in installations that make the plugin’s media‑library interface accessible to such users.

The CVSS score of 6.8 indicates moderate severity. The EPSS value is below 1%, suggesting that the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Author or higher to inject the malicious title, followed by a separate privileged user opening the media library, so the attack path involves two distinct role-based actions.