The Enable Media Replace WordPress plugin contains a stored cross‑site scripting flaw (CWE‑79) caused by improper sanitization of user input. Based on the description, it is inferred that an authenticated user with permission to replace media would need to upload a malicious payload via the plugin’s interface; the payload would then be persisted and rendered unfiltered in the the stored script can have arbitrary JavaScript executed in their browser, allowing attackers to hijack sessions, steal credentials, or deface content.

ShortPixel Enable Media Replace, versions up to 4.2.1, are affected. Newer releases starting with 4.2.2 are not affected, so upgrading to that or later versions will eliminate the flaw.

The CVSS classifies this as a medium‑severity issue. EPSS score is <1%, indicating a very low but non-zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating that large‑scale exploitation is currently unobserved. The attack vector is inferred as a stored input via the plugin’s on is inferred that the attacker likely needs to be an authenticated user with the necessary privileges to modify media.