Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: ShortPixel Component: Enable Media Replace Clear all filters
TI-2023-06157 CVE-2023-6737 · GHSA-fh2m-jg7j-ghwg

Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting

Priority LOW 28

The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and outp…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00493 Published 2024-01-11 No fix listed CWE-79
TI-2023-04280 CVE-2023-4643 · GHSA-h9gw-q7wq-vrfv

Enable Media Replace < 4.1.3 - Author+ PHP Object Injection

Priority HIGH 73

The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the b…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01052 Published 2023-10-16 Fixed in 4.1.3
TI-2023-00241 CVE-2023-0255 · GHSA-j47r-gcvh-59g7

Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload

Priority HIGH 73

The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01096 Published 2023-02-13 Fixed in 4.0.2 CWE-434
TI-2022-02359 CVE-2022-2554 · GHSA-pr9x-p233-rm4x

Enable Media Replace < 4.0.0 - Admin+ Path Traversal

Priority LOW 24

The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root director…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00972 Published 2022-10-10 Fixed in 4.0.0 CWE-22