CVE-2026-15253
Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title
- State
- Published
- Severity
- 6.8 Medium
- Published
- Aug 19, 2026
- Updated
- Aug 19, 2026
- Reserved
- Jul 9, 2026
Description
The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Easy Media ReplaceUnknown |
|
References
- https://wpscan.com/vulnerability/46eda528-3737-4c0d-bf72-df7fc6423907/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.