CVE-2026-57722: Enable Media Replace Stored XSS Flaw

CVE-2026-57722 Overview

CVE-2026-57722 is a stored cross-site scripting (XSS) vulnerability in the ShortPixel Enable Media Replace WordPress plugin. The flaw affects all versions up to and including 4.2.1. It stems from improper neutralization of user-supplied input during web page generation, classified as [CWE-79].

Exploitation requires an authenticated user with high privileges and a victim interaction to trigger the injected payload. Because the vulnerability crosses a security scope boundary, a successful attack can affect resources beyond the vulnerable component, including administrators viewing plugin-generated content.

Critical Impact
Attackers with high-privilege access can inject persistent JavaScript that executes in the browsers of other WordPress users, enabling session theft, administrative action forgery, and defacement of the WordPress backend.

Affected Products

ShortPixel Enable Media Replace WordPress plugin
Versions from n/a through 4.2.1
WordPress sites where the plugin is installed and active

Discovery Timeline

2026-07-01 - CVE-2026-57722 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57722

Vulnerability Analysis

The Enable Media Replace plugin allows WordPress administrators to swap existing media library files without changing the URL. The plugin renders user-controlled input in the WordPress admin interface without sufficient output encoding or input sanitization.

An attacker with high-privilege access supplies a malicious payload through an input field processed by the plugin. The payload is persisted in the WordPress database and later rendered in the admin dashboard when other users view affected pages. Because the payload persists across sessions, the attack qualifies as stored XSS rather than reflected.

The vulnerability affects confidentiality, integrity, and availability at a limited scope. The changed security scope reflects that JavaScript executed in an administrator context can perform actions across the WordPress installation rather than only within the vulnerable plugin.

Root Cause

The root cause is improper neutralization of input during web page generation. The plugin fails to apply WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() when handling and rendering user-supplied content in versions up to 4.2.1. This omission allows raw HTML and JavaScript to be stored and later returned to browsers as executable markup.

Attack Vector

The attack vector is network-based and requires authentication as a high-privilege user plus interaction from a second user to trigger the payload. A typical exploitation path involves:

The attacker authenticates to WordPress with sufficient privileges to use the Enable Media Replace plugin.
The attacker submits a payload containing a <script> tag or an HTML attribute with an event handler such as onerror through a vulnerable input field.
The plugin stores the payload without sanitization.
When an administrator or other user loads a page that renders the stored content, the browser executes the injected JavaScript in the WordPress admin origin.

Refer to the Patchstack WordPress Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-57722

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or HTML event handler attributes (onerror, onload, onclick) stored in WordPress wp_posts, wp_postmeta, or plugin-specific tables.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading the WordPress admin dashboard or media library.
New administrator accounts, modified user roles, or unexpected plugin installations following media replacement activity.

Detection Strategies

Audit the WordPress database for HTML markup and JavaScript stored in fields populated by the Enable Media Replace plugin.
Inspect WordPress admin pages while logged in as a non-privileged test account to identify unauthorized script execution.
Review web server access logs for POST requests to plugin endpoints containing encoded HTML or script payloads.

Monitoring Recommendations

Enable a Content Security Policy (CSP) in report-only mode on /wp-admin/ to surface inline script violations attributable to injected payloads.
Monitor WordPress audit logs for media replacement events performed by high-privilege accounts, especially outside normal working hours.
Alert on modifications to wp_users, wp_usermeta, and wp_options that follow media replace actions, which can indicate post-exploitation activity.

How to Mitigate CVE-2026-57722

Immediate Actions Required

Update the ShortPixel Enable Media Replace plugin to a version later than 4.2.1 once released by the vendor.
Restrict use of the plugin to trusted administrator accounts and remove unnecessary high-privilege users.
Review all media items and associated metadata added or modified since the plugin was installed for injected markup.

Patch Information

At the time of publication, the vulnerability affects Enable Media Replace versions from n/a through 4.2.1. Consult the Patchstack WordPress Vulnerability Report for the current patched version and vendor advisory updates.

Workarounds

Deactivate the Enable Media Replace plugin until a patched release is applied if media replacement functionality is not business-critical.
Deploy a web application firewall rule that blocks requests containing <script>, javascript:, or common event handler patterns targeting plugin endpoints.
Enforce a strict Content Security Policy on WordPress admin routes to prevent execution of inline scripts injected through stored XSS.

bash

# Example: disable the plugin via WP-CLI until a patch is applied
wp plugin deactivate enable-media-replace

# Example: search the database for stored script payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%onerror=%';"