# CVE-2026-57722: ShortPixel Enable Media Replace Stored XSS

Source: https://junglewise.ai/threats/cve-2026-57722-shortpixel-enable-media-replace-stored-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-57722 · Severity: medium · CVSS 5.9 · Published 2026-07-01

ShortPixel Enable Media Replace is a WordPress plugin used to easily swap old media files with new ones in the site's library. A security vulnerability in versions up to 4.2.1 allows an attacker with high-level administrative access to inject malicious scripts into the website. If a site visitor or another administrator views the affected page, these scripts could execute, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: [ShortPixel Enable Media Replace](https://junglewise.ai/threats/technologies/enable-media-replace). Vendors: [ShortPixel](https://junglewise.ai/threats/vendors/shortpixel).

## Quick answers

**Is CVE-2026-57722 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57722 being exploited in the wild.

**How severe is CVE-2026-57722?** Medium severity, with a CVSS score of 5.9, published 1 July 2026.

**Which products and versions are affected?** ShortPixel Enable Media Replace up to 4.2.1.

**Is there a fix for CVE-2026-57722?** A patch was published on 2026-07-01: Version 4.2.2 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57722 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57722?** Check whether you run ShortPixel Enable Media Replace at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the ShortPixel Enable Media Replace plugin for WordPress (versions up to 4.2.1). The flaw stems from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary web scripts. Exploitation requires high-level privileges (such as an Editor or Administrator role) and some degree of user interaction from another user. Successful exploitation allows the execution of malicious JavaScript in the context of the victim's browser, which can be used to bypass same-origin policy protections or hijack user sessions. The issue is addressed in version 4.2.2.

## Affected products

- ShortPixel Enable Media Replace up to 4.2.1

## Timeline

- 2026-06-24: other: Reported by researcher Ananda Dhakal
- 2026-07-01: advisory: Published by Patchstack
- 2026-07-01: patched: Version 4.2.2 released to address the vulnerability

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/enable-media-replace/vulnerability/wordpress-enable-media-replace-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/enable-media-replace/vulnerability/wordpress-enable-media-replace-plugin-4-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [Enable Media Replace PHP object injection](https://junglewise.ai/threats/cve-2026-73186-subscriber-php-object-injection-in-enable-media-replace-4-2-2)
- [ShortPixel Enable Media Replace stored XSS in location_dir parameter](https://junglewise.ai/threats/cve-2026-5714-shortpixel-enable-media-replace-stored-xss-in-location-dir)