---
id: "CVE-2026-114431"
kind: "vulnerability"
aliases: ["CVE-2026-114431"]
title: "WordPress Enable Media Replace: SVG uploads skip sanitizing, allowing stored script"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["no-untrusted-uploaders", "svg-support-disabled"]
published_at: "2026-11-04T06:17:00+00:00"
first_seen_at: "2026-11-04T06:25:18+00:00"
updated_at: "2026-11-04T06:26:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114431", "first_seen_at": "2026-11-04T06:25:18+00:00"}]
---

# WordPress Enable Media Replace: SVG uploads skip sanitizing, allowing stored script

The Enable Media Replace WordPress plugin before 4.2.3 replaces media files without running them through the WordPress upload filter, so SVG sanitizing is skipped. An authenticated user with upload access can store an SVG containing script that runs when the file is opened directly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Enable Media Replace plugin version in the WordPress admin under Plugins; flagged if below `4.2.3`.
- Confirm whether SVG uploads are enabled on the site (the plugin's SVG support must be active for the issue to apply).

## Fix

- Enable Media Replace: move to `4.2.3` or later.

## Timeline

- 2026-11-04T06:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114431

## From the sources

The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_