CVE-2026-57722 is a stored cross-site scripting (XSS) vulnerability in the ShortPixel Enable Media Replace plugin. It is caused by improper neutralization of input during web page generation, classified under CWE-79. The vulnerability affects versions up to 4.2.1, allowing an attacker with high privileges and requiring user interaction to execute scripts in a context that can compromise confidentiality, integrity, and availability of the affected system. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with high privileges to inject and execute malicious scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability. The attack requires user interaction and privileges, limiting the scope of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to input handling in the Enable Media Replace plugin.