Is CVE-2026-5714 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5714 being exploited in the wild.

How severe is CVE-2026-5714?

Medium severity, with a CVSS score of 6.4, published 9 June 2026.

Which products and versions are affected?

ShortPixel Enable Media Replace Up to and including 4.1.8.

Is there a fix for CVE-2026-5714?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5714 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-5714?

Check whether you run ShortPixel Enable Media Replace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5714: ShortPixel Enable Media Replace stored XSS in location_dir parameter

CVE-2026-5714 · Severity: medium · CVSS 6.4 · Published 2026-06-09

Enable Media Replace is a WordPress plugin that allows site administrators to easily replace existing media files in their library. A security flaw allows users with Author-level permissions or higher to inject malicious scripts into the site's management interface. If an administrator or another user views the affected page, these scripts could execute, potentially leading to unauthorized actions or data theft.

Technologies: ShortPixel Enable Media Replace. Vendors: ShortPixel.

Quick answers

Is CVE-2026-5714 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5714 being exploited in the wild.
How severe is CVE-2026-5714?: Medium severity, with a CVSS score of 6.4, published 9 June 2026.
Which products and versions are affected?: ShortPixel Enable Media Replace Up to and including 4.1.8.
Is there a fix for CVE-2026-5714?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5714 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-5714?: Check whether you run ShortPixel Enable Media Replace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'location_dir' parameter. This vulnerability exists in all versions up to and including 4.1.8. An authenticated attacker with Author-level permissions or higher can inject arbitrary web scripts into the database. These scripts will execute in the context of any user's browser who accesses the page where the injected content is displayed. The attack is delivered over the network and does not require interaction from the victim beyond visiting the compromised page.

Affected products

ShortPixel Enable Media Replace Up to and including 4.1.8

Timeline

2026-06-09: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.