CVE-2026-57722: Stored XSS in ShortPixel Enable Media Replace Plugin (CVSS 5.9)

Technical summary

CVE-2026-57722 is a stored XSS vulnerability (CWE-79) in the Enable Media Replace plugin caused by improper input sanitization during web page generation. The vulnerability allows authenticated users with elevated privileges to inject JavaScript code that persists in the application's data store. When subsequent users access pages containing the malicious payload, the script executes in their browsers within the context of the vulnerable application. The CVSS 3.1 score of 5.9 (MEDIUM severity) reflects the requirement for high-privilege authentication and user interaction to trigger the vulnerability, though the impact reaches across session boundaries (noted by the 'S:C' scope change in the vector).

Business impact

A successful attack could compromise user sessions, steal sensitive data entered into the web application, redirect users to malicious sites, or deface site content. For WordPress installations relying on Enable Media Replace for media management, this risk extends to any site visitor viewing pages containing injected content. Depending on the site's purpose and data sensitivity, impacts could range from reputational damage and user trust erosion to compliance violations if personal or financial data is harvested. The persistent nature of stored XSS means the attack remains active until the malicious payload is explicitly removed.

Affected systems

Enable Media Replace plugin versions through 4.2.1 are affected. The vulnerability likely impacts WordPress installations, though the vendor/product field in source data is empty, so confirmation of the full deployment context is advisable. Organizations using this plugin for media asset management should audit their installations against the version threshold.

Exploitability

Exploitation requires authenticated access at an elevated privilege level (editor, admin, or equivalent). This requirement substantially raises the bar compared to unauthenticated XSS attacks. However, privilege escalation vulnerabilities in WordPress or other plugins, compromised user accounts, or insider threats could provide the entry point. Once injected, the payload executes automatically with no additional user interaction from victims—only the initial injection requires UI interaction from the attacker. The network-accessible nature (AV:N) means any authenticated user on the internet can attempt injection if they possess valid credentials.

Remediation

Update Enable Media Replace to the earliest patched version available above 4.2.1. Verify the patch version against the official ShortPixel or WordPress plugin repository advisory. Additionally, implement strict input validation and output encoding on any custom code that processes media metadata. Restrict plugin editor and upload capabilities to trusted administrators, and consider disabling media replace functionality if not actively needed.

Patch guidance

Check the official ShortPixel Enable Media Replace plugin page on the WordPress.org plugin directory or the vendor's website for a version release newer than 4.2.1. Apply updates through the WordPress admin dashboard or manually upload the patched version. Before deploying to production, test the update in a staging environment to ensure compatibility with your media workflow and other plugins. Verify that the patch release notes explicitly address CVE-2026-57722.

Detection guidance

Monitor for suspicious script injection attempts in WordPress admin activity logs, especially in media library operations and post/page edits. Use Web Application Firewall (WAF) rules to detect common XSS payloads in POST requests to the media replace endpoint. Review stored content (posts, pages, media metadata) for unexpected JavaScript or HTML tags using automated content scanning. Enable WordPress security logging plugins to capture admin user actions and privilege escalations. Look for unusual network requests originating from your site's frontend that might indicate script execution.

Why prioritize this

Although the CVSS score is MEDIUM (5.9) and the vulnerability requires authenticated high-privilege access, stored XSS has a broad blast radius once injected—it affects all site visitors without additional attack steps. The persistent nature means remediation cannot be delayed indefinitely. Prioritize this for organizations with multiple admin users, high-traffic sites, or user-generated content scenarios where account compromise is plausible. For single-admin, low-traffic sites, this can follow critical patches but should not be deferred beyond the next maintenance cycle.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects: (1) Network-accessible attack vector, (2) Low attack complexity with no special conditions required, (3) High privilege requirement limiting attacker pool, (4) Required user interaction (the attacker must perform the injection), (5) Scope change because the impact crosses from the vulnerable component to other security contexts (site visitors), and (6) Low integrity impact (malicious content injection) with low confidentiality and availability impact. The privilege barrier prevents this from being high-severity, but the scope change and stored nature elevate it above the lowest tiers.

Frequently asked questions