Stored Cross-Site Scripting in Enable Media Replace file_modified Shortcode

The file_modified shortcode used its id and format attributes without sanitising them and passed the format string straight to the date formatter. A contributor-level user who can place the shortcode in a post could inject arbitrary JavaScript that runs in the browser of anyone viewing the page.

This vulnerability affects the following application versions:

• Enable Media Replace 3.3.0
• Enable Media Replace 3.3.1
• Enable Media Replace 3.3.2
• Enable Media Replace 3.3.3
• Enable Media Replace 3.3.4
• Enable Media Replace 3.3.5
• Enable Media Replace 3.3.6
• Enable Media Replace 3.3.7
• Enable Media Replace 3.3.8
• Enable Media Replace 3.3.9
• Enable Media Replace 3.3.10
• Enable Media Replace 3.3.11
• Enable Media Replace 3.3.12
• Enable Media Replace 3.4.0
• Enable Media Replace 3.4.1
• Enable Media Replace 3.4.2
• Enable Media Replace 3.5.0
• Enable Media Replace 3.6.0
• Enable Media Replace 3.6.1
• Enable Media Replace 3.6.2
• Enable Media Replace 3.6.3
• Enable Media Replace 4.0.0
• Enable Media Replace 4.0.1
• Enable Media Replace 4.0.2
• Enable Media Replace 4.0.3
• Enable Media Replace 4.1.0
• Enable Media Replace 4.1.1
• Enable Media Replace 4.1.2
• Enable Media Replace 4.1.3
• Enable Media Replace 4.1.4
• Enable Media Replace 4.1.5
• Enable Media Replace 4.1.6