Enable Media Replace up to and including 4.1.8 printed the error message and error description into the error view without HTML escaping. Upstream added esc_html() to both outputs in 4.1.9. The values originate from a fixed set of plugin-supplied translated strings, so this is defence-in-depth hardening rather than a reachable injection point.
This vulnerability affects the following application versions:
- Enable Media Replace 4.1.0
- Enable Media Replace 4.1.1
- Enable Media Replace 4.1.2
- Enable Media Replace 4.1.3
- Enable Media Replace 4.1.4
- Enable Media Replace 4.1.5
- Enable Media Replace 4.1.6
- Enable Media Replace 4.1.7
- Enable Media Replace 4.1.8