Reflected Cross-Site Scripting Vulnerability in Enable Media Replace Plugin for WordPress
CVE-2023-6737

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Enable Media Replace
Vendor
CVE Published:
11 January 2024

Summary

The Enable Media Replace plugin for WordPress fails to adequately sanitize and escape user inputs, allowing unauthenticated attackers to exploit the SHORTPIXEL_DEBUG parameter. By tricking users into clicking malicious links, attackers can inject and execute arbitrary web scripts on affected sites. This vulnerability affects all versions up to and including 4.1.4, posing a substantial risk if the ID of an uploaded attachment is known to the attacker.

Affected Version(s)

Enable Media Replace * <= 4.1.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nex Team
.