CVE-2023-0255high

CVE-2023-0255: high-severity vulnerability in Enable Media Replace

Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor Enable Media Replace

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 1.1%
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Enable Media Replace
Related CVEs — Enable Media Replace

In the same product, most dangerous first.

CVE-2023-4643HIGHEnable Media Replace < 4.1.3 - Author+ PHP Object InjectionEPSS 1.1%CVE-2022-2554—Enable Media Replace < 4.0.0 - Admin+ Path TraversalEPSS 1.0%CVE-2026-114422HIGHEnable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata ReplacerEPSS 0.5%CVE-2026-114431MEDIUMEnable Media Replace < 4.2.3 - Author+ Stored XSS via SVG UploadEPSS 0.2%