{"id":"CVE-2026-114431","kind":"vulnerability","aliases":["CVE-2026-114431"],"related":[],"title":"WordPress Enable Media Replace: SVG uploads skip sanitizing, allowing stored script","description":"The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.","summary":"The Enable Media Replace WordPress plugin before 4.2.3 replaces media files without running them through the WordPress upload filter, so SVG sanitizing is skipped. An authenticated user with upload access can store an SVG containing script that runs when the file is opened directly.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["no-untrusted-uploaders","svg-support-disabled"],"how_to_check":"- Check the installed Enable Media Replace plugin version in the WordPress admin under Plugins; flagged if below `4.2.3`.\n- Confirm whether SVG uploads are enabled on the site (the plugin's SVG support must be active for the issue to apply).","fix":"- Enable Media Replace: move to `4.2.3` or later.","status":"open","published_at":"2026-11-04T06:17:00+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:21+00:00","updated_at":"2026-11-04T06:26:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:21Z","model":"claude-haiku-5-5","output":{"fix":"- Enable Media Replace: move to `4.2.3` or later.","reach":"network","title":"WordPress Enable Media Replace: SVG uploads skip sanitizing, allowing stored script","impact":"medium","summary":"The Enable Media Replace WordPress plugin before 4.2.3 replaces media files without running them through the WordPress upload filter, so SVG sanitizing is skipped. An authenticated user with upload access can store an SVG containing script that runs when the file is opened directly.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Stored script runs in visitors' browsers when the SVG is opened","analyst_note":"","how_to_check":"- Check the installed Enable Media Replace plugin version in the WordPress admin under Plugins; flagged if below `4.2.3`.\n- Confirm whether SVG uploads are enabled on the site (the plugin's SVG support must be active for the issue to apply).","plain_action":"","needs_analyst":false,"not_affected_if":["svg-support-disabled","no-untrusted-uploaders"],"who_is_affected":"Sites running the Enable Media Replace WordPress plugin before 4.2.3 with SVG support enabled, where some users can upload media. The replace path is the entry point, so sites without SVG support enabled or without untrusted upload users are less exposed. unknown whether the sources list further conditions.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4208,"output_tokens":563,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114431':14A,17A '-2026':13A,16A '4.2.3':31B,75C,102C,141C 'access':53B,113C 'activ':144C 'allow':9A,107C 'authent':49B,109C 'contain':58B,119C 'cve':12A,15A 'direct':67B,128C 'enabl':2A,25B,69C,96C,134C,135C 'execut':122C 'file':34B,64B,82C,118C,125C 'filter':42B 'host':22B 'media':3A,26B,33B,70C,81C,97C,136C 'never':105C 'open':66B,127C 'otherwis':149C 'packag':18B 'pass':78C 'path':148C 'php':19B 'pipelin':87C 'plugin':29B,73C,100C,139C 'prefilt':91C 'reject':150C 'reli':103C 'replac':4A,27B,32B,71C,80C,98C,137C,147C 'requir':130C 'run':36B,61B,106C 'sanit':8A,45B,95C 'script':11A,59B,120C 'self':21B 'self-host':20B 'skip':7A,47B 'store':10A,55B,115C 'svg':5A,44B,57B,94C,117C,133C,151C 'svg-enabl':132C 'svg-sanit':93C 'upload':6A,41B,52B,86C,90C,112C,152C 'user':50B,110C 'without':35B 'wordpress':1A,23B,28B,40B,72C,85C,99C,138C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Enable Media Replace WordPress plugin before 4.2.3 with SVG support enabled, where some users can upload media. The replace path is the entry point, so sites without SVG support enabled or without untrusted upload users are less exposed. unknown whether the sources list further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114431","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114431","severity":null,"published_at":"2026-11-04T06:17:00+00:00","modified_at":"2026-11-04T06:17:00+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}