Enable Media Replace

The file_modified shortcode used its id and format attributes without sanitising them and passed the format string straight to the date formatter. A contributor-level user who can place the shortcode in a post could inject arbitrary JavaScript that runs in the browser of anyone viewing the page.

This vulnerability affects the following application versions:

• Enable Media Replace 3.3.0
• Enable Media Replace 3.3.1
• Enable Media Replace 3.3.2
• Enable Media Replace 3.3.3
• Enable Media Replace 3.3.4
• Enable Media Replace 3.3.5
• Enable Media Replace 3.3.6
• Enable Media Replace 3.3.7
• Enable Media Replace 3.3.8
• Enable Media Replace 3.3.9
• Enable Media Replace 3.3.10
• Enable Media Replace 3.3.11
• Enable Media Replace 3.3.12
• Enable Media Replace 3.4.0
• Enable Media Replace 3.4.1
• Enable Media Replace 3.4.2
• Enable Media Replace 3.5.0
• Enable Media Replace 3.6.0
• Enable Media Replace 3.6.1
• Enable Media Replace 3.6.2
• Enable Media Replace 3.6.3
• Enable Media Replace 4.0.0
• Enable Media Replace 4.0.1
• Enable Media Replace 4.0.2
• Enable Media Replace 4.0.3
• Enable Media Replace 4.1.0
• Enable Media Replace 4.1.1
• Enable Media Replace 4.1.2
• Enable Media Replace 4.1.3
• Enable Media Replace 4.1.4
• Enable Media Replace 4.1.5
• Enable Media Replace 4.1.6

Enable Media Replace up to and including 4.1.8 renders the ‘location_dir’ value into an HTML attribute on the media replace screen without escaping it. An authenticated attacker with Author-level access or above can break out of the attribute and inject arbitrary JavaScript, which then executes for any user who views the affected page.

This vulnerability affects the following application versions:

• Enable Media Replace 3.5.0
• Enable Media Replace 3.6.0
• Enable Media Replace 3.6.1
• Enable Media Replace 3.6.2
• Enable Media Replace 3.6.3
• Enable Media Replace 4.0.0
• Enable Media Replace 4.0.1
• Enable Media Replace 4.0.2
• Enable Media Replace 4.0.3
• Enable Media Replace 4.1.0
• Enable Media Replace 4.1.1
• Enable Media Replace 4.1.2
• Enable Media Replace 4.1.3
• Enable Media Replace 4.1.4
• Enable Media Replace 4.1.5
• Enable Media Replace 4.1.6
• Enable Media Replace 4.1.7
• Enable Media Replace 4.1.8

Enable Media Replace up to and including 4.1.8 printed CSS class values into HTML attributes in the upsell view without escaping. Upstream added esc_attr() to two of these outputs in 4.1.9. The values are assigned from fixed literals, so this is defence-in-depth hardening rather than a reachable injection point.

This vulnerability affects the following application versions:

• Enable Media Replace 4.1.8

Enable Media Replace up to and including 4.1.8 printed the error message and error description into the error view without HTML escaping. Upstream added esc_html() to both outputs in 4.1.9. The values originate from a fixed set of plugin-supplied translated strings, so this is defence-in-depth hardening rather than a reachable injection point.

This vulnerability affects the following application versions:

• Enable Media Replace 4.1.0
• Enable Media Replace 4.1.1
• Enable Media Replace 4.1.2
• Enable Media Replace 4.1.3
• Enable Media Replace 4.1.4
• Enable Media Replace 4.1.5
• Enable Media Replace 4.1.6
• Enable Media Replace 4.1.7
• Enable Media Replace 4.1.8