4.0.1

DATE	CVE	VULNERABILITY TITLE	RISK
2024-01-11	CVE-2023-6737	Cross-site Scripting vulnerability in Shortpixel Enable Media Replace The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. network low complexity shortpixel CWE-79	6.1
2023-10-16	CVE-2023-4643	Unspecified vulnerability in Shortpixel Enable Media Replace The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog network low complexity shortpixel	8.8
2023-02-13	CVE-2023-0255	Unrestricted Upload of File with Dangerous Type vulnerability in Shortpixel Enable Media Replace The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. network low complexity shortpixel CWE-434	8.8