Enable Media Replace

WordPress plugin · enable-media-replace · WordPress.org ↗

Latest v4.2.3 Last release Oct 26, 2026 Tested up to WP 7.1.4 600,000+ active installs

Critical

High

Known total

Unfixed

Running Enable Media Replace on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.5	Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer CVE.org	>=4.1.4, <4.2.3	v4.2.3	CVE-2026-114422	Oct 30, 2026
HIGH CVSS 8.8	Enable Media Replace [enable-media-replace] < 4.2.3 WPVulnerability	< 4.2.3	v4.2.3	CVE-2026-73186	Oct 28, 2026
HIGH CVSS 7.1	Enable Media Replace [enable-media-replace] < 4.1.6 WPVulnerability	< 4.1.6	v4.1.6	CVE-2025-31081	Apr 1, 2025
HIGH CVSS 8.8	Enable Media Replace [enable-media-replace] < 4.1.3 WPVulnerability · PoC available	< 4.1.3	v4.1.3	CVE-2023-4643	Sep 14, 2023
HIGH CVSS 8.8	Enable Media Replace [enable-media-replace] < 4.0.2 WPVulnerability · PoC available	< 4.0.2	v4.0.2	CVE-2023-0255	Jan 17, 2023
MEDIUM CVSS 6.4	Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload CVE.org	>=0, <4.2.3	v4.2.3	CVE-2026-114431	Nov 4, 2026
MEDIUM CVSS 4.3	Enable Media Replace [enable-media-replace] < 4.2.3 WPVulnerability	< 4.2.3	v4.2.3	CVE-2026-85655	Jul 1, 2026
MEDIUM CVSS 5.9	Enable Media Replace [enable-media-replace] < 4.2.2 WPVulnerability	< 4.2.2	v4.2.2	CVE-2026-57722	Jun 8, 2026
MEDIUM CVSS 6.4	Enable Media Replace [enable-media-replace] < 4.1.9 WPVulnerability	< 4.1.9	v4.1.9	CVE-2026-5714	Jun 8, 2026
MEDIUM CVSS 6.4	Enable Media Replace [enable-media-replace] < 4.1.7 WPVulnerability	< 4.1.7	v4.1.7	CVE-2025-9496	Oct 10, 2025
MEDIUM CVSS 6.1	Enable Media Replace [enable-media-replace] < 4.1.5 WPVulnerability	< 4.1.5	v4.1.5	CVE-2023-6737	Dec 18, 2023
MEDIUM CVSS 4.9	Enable Media Replace [enable-media-replace] < 4.0.0 WPVulnerability	< 4.0.0	v4.0.0	CVE-2022-2554	Sep 14, 2022
UNKNOWN	Enable Media Replace [enable-media-replace] < 4.2.3 WPVulnerability	< 4.2.3	v4.2.3	CVE-2026-114431	Oct 30, 2026
UNKNOWN	Enable Media Replace [enable-media-replace] >= 4.1.4 - < 4.2.3 WPVulnerability	>= 4.1.4, < 4.2.3	v4.2.3	CVE-2026-114422	Oct 30, 2026
UNKNOWN	Enable Media Replace [enable-media-replace] < 4.1.8 WPVulnerability	< 4.1.8	v4.1.8	CVE-2026-2732	Mar 3, 2026
UNKNOWN	Enable Media Replace [enable-media-replace] < 4.1.3 WPVulnerability	< 4.1.3	v4.1.3	—	Sep 15, 2023
UNKNOWN	Enable Media Replace [enable-media-replace] < 2.4 WPVulnerability	< 2.4	v2.4	—	Feb 9, 2011
UNKNOWN	Enable Media Replace [enable-media-replace] < 2.4 WPVulnerability	< 2.4	v2.4	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.