CVE-2026-5714 is a stored cross-site scripting vulnerability in the Enable Media Replace WordPress plugin (versions up to 4.1.8). The issue is caused by improper neutralization of input in the 'location_dir' parameter, allowing authenticated users with Author-level or higher privileges to inject arbitrary web scripts. These scripts execute when a user accesses an injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the level of an authenticated author, no user interaction needed, and impacts confidentiality and integrity with no availability impact. No official fix or patch is currently documented.

An authenticated attacker with Author-level access or higher can exploit this vulnerability to inject and execute arbitrary scripts in the context of affected pages. This can lead to unauthorized actions such as session hijacking or data manipulation for users who view the injected content. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Author-level access to trusted users only and consider removing or disabling the Enable Media Replace plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.