CVE-2025-9496

MediumCVSS 6.4

Published: 11/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Risk Assessment

The organization may experience malicious script execution in users' browsers, potentially leading to data theft, session hijacking, or other attacks.

Recommendation

It is recommended to update the Enable Media Replace plugin to the latest patched version and restrict user privileges to the minimum necessary.

Other vulnerabilities in Enable Media Replace

CVE-2026-57722Medium
The Enable Media Replace WordPress plugin contains a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. This affects versions from n/a through 4.2.1.

Original NVD description (English source)

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS