How many ShortPixel Enable Media Replace CVEs are in CISA KEV?

None of ShortPixel Enable Media Replace's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of ShortPixel Enable Media Replace are affected?

22 distinct ShortPixel Enable Media Replace versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in ShortPixel Enable Media Replace CVEs?

ShortPixel Enable Media Replace's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-862 (Missing Authorization).

What is the average severity of ShortPixel Enable Media Replace CVEs?

The average CVSS base score across ShortPixel Enable Media Replace's scored CVEs is 6.6.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

ShortPixel

9 CVEs

ShortPixel Enable Media Replace Vulnerabilities

Name: ShortPixel Enable Media Replace vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Enable Media Replace by ShortPixel.

9

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

2

Public exploits

PoC or exploit code

6.6

Avg CVSS

2022–2026

Last updated July 1, 2026

Overview

ShortPixel Enable Media Replace has 9 published CVE records since 2022, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 6.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting ShortPixel Enable Media Replace, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of ShortPixel Enable Media Replace's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High3

Medium6

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of ShortPixel Enable Media Replace's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2

2 of ShortPixel Enable Media Replace's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every ShortPixel Enable Media Replace version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 4.0.01 CVE
< 4.0.21 CVE
< 4.1.31 CVE
<= 4.1.41 CVE
<= 4.1.51 CVE
<= 4.1.61 CVE
<= 4.1.71 CVE
<= 4.1.81 CVE
<= 4.2.11 CVE
>= 4.1.61 CVE
>= 4.2.21 CVE

Fixed in

> 4.1.41 CVE
> 4.1.51 CVE
> 4.1.61 CVE
> 4.1.71 CVE
> 4.1.81 CVE
> 4.2.11 CVE
4.0.01 CVE
4.0.21 CVE
4.1.31 CVE
4.1.61 CVE
4.2.21 CVE

Find a version

9 CVEs

Sort

WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-57722
Patch
CWE-79
Medium · CVSS 5.9
EPSS 0.1% (5th pct)2026-07-01
Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
CVE-2026-5714
Patch
CWE-79
Medium · CVSS 6.4
EPSS 0.3% (17th pct)2026-06-09
Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
CVE-2026-2732
Patch
CWE-862
Medium · CVSS 5.4
EPSS 0.2% (13th pct)2026-03-04
Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode
CVE-2025-9496
Patch
CWE-79
Medium · CVSS 6.4
EPSS 0.2% (13th pct)2025-10-11
WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2025-31081
Patch
CWE-79
High · CVSS 7.1
EPSS 0.4% (32th pct)2025-04-01
Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting
CVE-2023-6737
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.5% (40th pct)2024-01-11
High vulnerability · 2023-10-16
CVE-2023-4643
Public exploit
Patch
High · CVSS 8.8
EPSS 0.8% (54th pct)2023-10-16
High vulnerability · 2023-02-13
CVE-2023-0255
Public exploit
Patch
High · CVSS 8.8
EPSS 1.1% (62th pct)2023-02-13
Medium vulnerability · 2022-10-10
CVE-2022-2554
Patch
CWE-22
Medium · CVSS 4.9
EPSS 0.8% (53th pct)2022-10-10

Common weakness types

The CWE weakness categories most often found in ShortPixel Enable Media Replace CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many ShortPixel Enable Media Replace CVEs were published each year.

2022

1

2023

2

2024

1

2025

2

2026

3

Other ShortPixel products

Browse vulnerabilities for other products by ShortPixel.

ShortPixel Adaptive Images9 CVEs ShortPixel Image Optimizer3 CVEs ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF3 CVEs ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization2 CVEs image optimizer1 CVEs ShortPixel Adaptive Images (WordPress plugin)1 CVEs ShortPixel Critical CSS1 CVEs WP SVG Images1 CVEs

All ShortPixel vulnerabilities

Frequently asked questions

Common questions about ShortPixel Enable Media Replace vulnerabilities.

How many CVEs does ShortPixel Enable Media Replace have?: ShortPixel Enable Media Replace has 9 published CVE records since 2022.
How many ShortPixel Enable Media Replace CVEs are in CISA KEV?: None of ShortPixel Enable Media Replace's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for ShortPixel Enable Media Replace vulnerabilities?: Yes — 2 of ShortPixel Enable Media Replace's CVEs have a known public exploit.
Which versions of ShortPixel Enable Media Replace are affected?: 22 distinct ShortPixel Enable Media Replace versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in ShortPixel Enable Media Replace CVEs?: ShortPixel Enable Media Replace's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-862 (Missing Authorization).
What is the average severity of ShortPixel Enable Media Replace CVEs?: The average CVSS base score across ShortPixel Enable Media Replace's scored CVEs is 6.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track ShortPixel Enable Media Replace vulnerabilities

Monitor new ShortPixel Enable Media Replace vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing