The Easy Media Replace WordPress plugin through version 0.2.0 contains a CWE-79 Cross-Site Scripting vulnerability. Specifically, it does not sanitize or escape attachment titles before rendering them in HTML attributes in the media library list view. This enables users with the Author role and above to inject malicious scripts that execute in the context of higher privileged users who access the media library, potentially leading to session hijacking or other script-based attacks.

An attacker with Author-level access can inject arbitrary JavaScript code that executes in the browsers of users with higher privileges (e.g., Editors or Administrators) when they view the media library. This could lead to unauthorized actions performed with elevated privileges or theft of sensitive information accessible to those users. However, there is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level user capabilities if possible and limit access to the media library to trusted users only. Monitor official Easy Media Replace plugin channels for updates addressing this vulnerability.