Description

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-19T06:17:34.360Z",
  "pubdate": "2026-08-19T06:17:34.360Z",
  "executiveSummary": "The Easy Media Replace WordPress plugin through version 0.2.0 suffers from a Stored Cross-Site Scripting (XSS) vulnerability residing within the media library list view. This security defect arises due to the lack of proper input sanitization and output escaping applied to attachment titles before they are rendered inside HTML attributes. Consequently, authenticated malicious actors possessing the Author role or higher can inject arbitrary JavaScript payloads into attachment metadata. When a higher-privileged user, such as an Administrator, accesses the media library and views the affected media item, the injected script executes within the context of their active browser session. This exploitation vector effectively bridges privilege boundaries, allowing lower-privileged users to compromise administrative accounts, execute unauthorized administrative actions, or perform malicious actions on behalf of the victim. The risk implication is significant as it facilitates privilege escalation via stored payload execution within administrative interfaces. Exploitation requires authenticated access with specific minimum role requirements and user interaction in the form of viewing the vulnerable media library list interface.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS) stemming from improper neutralization of user-supplied data during web page generation. The vulnerable component is the media library list view rendering engine within the Easy Media Replace WordPress plugin through version 0.2.0. The root cause of the defect is the direct output of attachment titles into HTML attributes without prior sanitization or contextual HTML escaping. During the execution flow, an attacker with Author-level privileges or higher creates or modifies a media attachment, supplying a malicious payload within the attachment title field. The application stores this unsanitized string persistently in the underlying database without applying adequate validation or filtering mechanisms. When a higher-privileged user navigates to the media library list view, the application retrieves the malicious attachment title from the database and injects it directly into an HTML attribute during DOM construction. Because the output lacks appropriate escaping mechanisms, the browser interprets the payload as executable code rather than plain text or attribute data. When the victim views the media library, the injected script executes in the victim's browser session, inheriting their security context, session cookies, and administrative privileges. The attack flow relies entirely on internal application logic, executing locally within the administrative dashboard when administrative users interact with the crafted media entry. Post-exploitation impact includes session hijacking, unauthorized creation of rogue administrative accounts, execution of arbitrary administrative functions, and further compromise of the underlying WordPress installation."
}