https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T16:30:42.230506+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-15253 CVE-2026-15253 — Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title 2026-09-30T16:30:42.236740+00:00

Affected: Unknown Easy Media Replace

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who views the media library.