CVE-2026-5714: Enable Media Replace Plugin XSS Flaw

CVE-2026-5714 Overview

CVE-2026-5714 is a Stored Cross-Site Scripting (XSS) vulnerability in the Enable Media Replace plugin for WordPress. The flaw affects all versions up to and including 4.1.8. The vulnerability stems from insufficient input sanitization and output escaping on the location_dir parameter. Authenticated attackers with Author-level access or higher can inject arbitrary JavaScript that executes when users visit affected pages. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact

Authenticated attackers with Author-level privileges can inject persistent JavaScript payloads that execute in the context of any user viewing the affected page, enabling session theft, administrative action hijacking, and site defacement.

Affected Products

• Enable Media Replace plugin for WordPress, all versions through 4.1.8
• WordPress installations that grant Author-level or higher access to untrusted users
• Sites running the vulnerable UploadViewController.php and screen.php components

Discovery Timeline

• 2026-06-09 - CVE-2026-5714 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-5714

Vulnerability Analysis

The Enable Media Replace plugin processes the location_dir parameter without applying adequate sanitization before storing the value. When the stored data is later rendered, output escaping is also absent, allowing raw HTML and JavaScript to reach the browser. The vulnerable code paths reside in classes/ViewController/UploadViewController.php and views/screen.php, as documented in the WordPress Plugin Code View.

Because the injected payload persists in the database, every subsequent visitor to the affected page triggers execution. The scope is changed (S:C in the CVSS vector), meaning the injected script can affect resources beyond the vulnerable component, including administrator sessions.

Root Cause

The root cause is missing input validation on the location_dir request parameter combined with missing output escaping when the value is rendered in the upload screen template. Standard WordPress sanitization functions such as sanitize_text_field() and escaping helpers like esc_attr() or esc_html() are not applied at the relevant code locations referenced in the Wordfence Vulnerability Report.

Attack Vector

An authenticated attacker with Author-level access submits a crafted location_dir value containing JavaScript through the plugin's upload workflow. The payload is stored and later reflected into the page DOM without escaping. When an administrator or another user visits the page, the script executes with that user's privileges, enabling actions such as creating administrator accounts, exfiltrating nonces, or modifying site content. The vulnerability manifests in the rendering path documented in the screen.php source.

Detection Methods for CVE-2026-5714

Indicators of Compromise

• Unexpected <script> tags, event handlers, or encoded JavaScript stored in posts, pages, or plugin-related metadata
• HTTP POST requests containing JavaScript syntax in the location_dir parameter to Enable Media Replace endpoints
• Creation of new administrator accounts or modified user roles following Author-level activity
• Outbound requests from administrator browsers to unfamiliar domains immediately after viewing media replace pages

Detection Strategies

• Review WordPress access logs for requests to enable-media-replace endpoints containing suspicious location_dir values
• Audit the wp_posts and wp_postmeta tables for stored content containing <script>, onerror=, onload=, or javascript: strings
• Monitor for Author-level accounts performing media replacement operations followed by privilege changes

Monitoring Recommendations

• Enable WordPress audit logging to capture parameter values submitted to plugin endpoints
• Deploy a Web Application Firewall with rules targeting XSS patterns in plugin parameters
• Alert on any modification of administrator accounts originating from Author-level sessions
• Track plugin version inventory to identify hosts still running Enable Media Replace 4.1.8 or earlier

How to Mitigate CVE-2026-5714

Immediate Actions Required

• Update the Enable Media Replace plugin to a version above 4.1.8 once the vendor releases a fix
• Audit all Author-level and higher accounts and remove any that are unnecessary or unrecognized
• Inspect existing posts and pages for injected scripts and remove malicious content
• Rotate session tokens and administrator passwords if Author-level accounts show suspicious activity

Patch Information

At the time of publication, the Wordfence Vulnerability Report identifies all versions through 4.1.8 as vulnerable. Site operators should monitor the official plugin repository for a patched release and apply it immediately when available.

Workarounds

• Deactivate the Enable Media Replace plugin until a patched version is published
• Restrict the Author role and above to trusted users only, minimizing the pool of accounts that can exploit the flaw
• Deploy WAF rules that block JavaScript-like patterns submitted to the location_dir parameter
• Apply Content Security Policy headers that disallow inline script execution to limit payload impact

# Example WAF rule pattern (ModSecurity) to block script payloads in location_dir
SecRule ARGS:location_dir "@rx (?i)(<script|javascript:|onerror=|onload=)" \
  "id:1026571,phase:2,deny,status:403,log,msg:'CVE-2026-5714 XSS attempt in location_dir'"