Quick answers
- Is CVE-2026-114431 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114431 being exploited in the wild.
- How severe is CVE-2026-114431?
- Informational severity, published 4 November 2026.
- Which products and versions are affected?
- WP Media Enable Media Replace before 4.2.3.
- Is there a fix for CVE-2026-114431?
- Yes: fixed in 4.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114431 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-114431?
- Check whether you run WP Media Enable Media Replace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.2.3
Technical details
The plugin's media replacement function bypasses the WordPress upload pipeline sanitization filters that would normally strip malicious content from SVG files. An authenticated attacker with upload capability can store an SVG file containing script tags; when the file is accessed directly in a browser, the embedded JavaScript executes. The vulnerability requires an SVG-enabling plugin to be active, as the replace function otherwise rejects SVG uploads.
Affected products
- WP Media Enable Media Replace before 4.2.3
Timeline
- 2026-11-02: disclosed
- 2026-11-04: advisory