CVE-2026-15253

Easy Media Replace, a WordPress plugin for swapping media attachments, does not sanitise or escape the attachment title before outputting it inside an HTML attribute in the media library list view. Any user with Author privileges or higher can save an attachment title containing arbitrary web script, which then executes in the browser of an administrator or other higher-privileged user who opens the media library list view. A successful injection lets the attacker act within the victim's session, for example creating rogue admin accounts or altering site content. All WordPress sites running the plugin at version 0.2.0 or earlier are affected. Exploitation has not been reported in the wild; a public proof of concept exists, and EPSS currently estimates only a 0.3% chance of exploitation within 30 days.

What to do: WordPress administrators running Easy Media Replace 0.2.0 or earlier should update to the latest patched release as soon as one is available (no fixed version number is given in the current data). Until patching, deactivate the plugin or restrict media uploads and title editing to fully trusted users, and review existing attachment titles for injected script markup that would fire when an admin views the media list. Because a public proof of concept exists, treat any site with Author-role contributors on an unpatched version as exposed and check recent administrator activity for signs of session abuse.