Cross-Site Scripting Vulnerability in Easy Media Replace Plugin for WordPress
CVE-2026-15253
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15253?
The Easy Media Replace plugin for WordPress, through version 0.2.0, contains a vulnerability that allows arbitrary web scripts to be injected into HTML attributes. This occurs because the plugin fails to adequately sanitize and escape attachment titles before rendering them in the media library list view. As a result, users with Author roles and higher could exploit this vulnerability, potentially executing malicious scripts in the browsers of privileged users viewing the media library.
Affected Version(s)
Easy Media Replace 0 <= 0.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.