Skip to content
PluginCanary

Enable Media Replace

by ShortPixel · 600,000+ active installs · Checked 4 Nov 2026
Watch

Watch: held back by a low Support score (40 of 100).

78/ 100 Canary Score
Sub-scores for Enable Media Replace
Ownership100
Maintenance100
Security60
Support40
ReputationNo data

How the score works

Quick answers

Is Enable Media Replace still maintained?
Yes. Last release 26 Oct 2026, 8 releases in the last 24 months. 26 Oct 2026 · wordpress.org
Who owns Enable Media Replace, and has it changed hands?
No change recorded. Main committer petredobrescu since Mar 2020. 4 Nov 2026 · SVN log
Was Enable Media Replace removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is Enable Media Replace safe?
12 known vulnerabilities, all fixed (latest in 4.2.3). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest Enable Media Replace update safe to install?
No ownership change before 4.2.3. No one-star spike after it. 26 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
ShortPixel6 Mar 2018 to 23 Feb 2020, 36 commits
petredobrescu10 Mar 2020 to 26 Oct 2026, 52 commits

2 committers recorded. No ownership change since 2009.

Maintenance

Last release
9 days ago
Releases, 24 months
8
Tested up to
7.1 current
Requires PHP
5.6 supported 8.2+
Releases per quarter
Releases per quarter for Enable Media Replace
Q1 20240
Q2 20240
Q3 20240
Q4 20240
Q1 20251
Q2 20250
Q3 20250
Q4 20251
Q1 20261
Q2 20264
Q3 20260
Q4 20261

Last release 26 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.4.

Average rating per quarter for Enable Media Replace
Q4 20233.0
Q1 20243.0
Q2 20244.5
Q3 20245.0
Q4 20244.0
Q1 20254.5
Q2 20255.0
Q3 20252.0
Q4 20255.0
Q1 20265.0
Q2 20263.0
Q3 20265.0

Average rating rose from 3.0 to 5.0 between Q4 2023 and Q3 2026.

Rating distribution
5 star241
4 star13
3 star10
2 star6
1 star32
Latest low reviews

Security record

8 vulnerabilities in 24 months (12 on record), all patched (latest fixed in 4.2.3).

Show 12 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Enable Media Replace <= 4.2.2 - Authenticated (Subscriber+) PHP Object Injection7.5<= 4.2.24.2.3Patched before disclosure
28 Oct 2026Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection8.14.1.4 to 4.2.24.2.3Patched before disclosure
27 Oct 2026Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow4.3<= 4.2.24.2.3Patched before disclosure
1 Jul 2026Enable Media Replace <= 4.2.1 - Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 4.2.14.2.2Patched before disclosure
8 Jun 2026Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter6.4<= 4.1.84.1.9Patched before disclosure
3 Mar 2026Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace5.4<= 4.1.74.1.8Patched before disclosure
10 Oct 2025Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode6.4<= 4.1.64.1.7Patched before disclosure
1 Apr 2025Enable Media Replace <= 4.1.5 - Reflected Cross-Site Scripting6.1<= 4.1.54.1.6Patched before disclosure
18 Dec 2023Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting4.7<= 4.1.44.1.5Patched before disclosure
14 Sep 2023Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection6.6< 4.1.34.1.3Patched before disclosure
17 Jan 2023Enable Media Replace <= 4.0.1 - Authenticated (Author+) Arbitrary File Upload8.8<= 4.0.14.0.2Patched before disclosure
14 Sep 2022Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal6.8<= 3.6.34.0.0Patched before disclosure

Changelog mentions of security fixes: 4.2.2 (XSS); 4.2.3 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

40% of 5 support threads resolved in the last 2 months.

Momentum

600,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Enable Media Replace
4 May 202610,007
11 May 202631,704
18 May 202648,517
25 May 202625,635
1 Jun 202622,991
8 Jun 202627,211
15 Jun 2026215,900
22 Jun 2026250,409
29 Jun 2026262,375
6 Jul 202670,810
13 Jul 202636,596
20 Jul 202637,640
27 Jul 202629,427
3 Aug 202627,028
10 Aug 202622,581
17 Aug 202622,141
24 Aug 202624,506
31 Aug 202622,288
7 Sep 202619,579
14 Sep 202619,949
21 Sep 202621,574
28 Sep 202621,158
5 Oct 202621,038
12 Oct 202619,836
19 Oct 202631,256
26 Oct 2026315,037
2 Nov 202615,842

Weekly downloads over the last 4 weeks are 54% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

reGenerate Thumbnails AdvancedScore 100 · 60,000+File Upload Types by WPFormsScore 100 · 40,000+WP SVG ImagesScore 100 · 30,000+Media Library CategoriesScore 100 · 20,000+No Right Click ImagesScore 100 · 20,000+

Facts

Version4.2.3
AuthorShortPixel
Added1 Jun 2009
Last updated26 Oct 2026
Active installs600,000+
Requires WordPress4.9.7
Tested up to7.1.4
Requires PHP5.6
CategoryContent Management > Document Management & Downloads
Tagsreplace, replace jpg, change media, replace image, remove background

Other plugins by this author: ShortPixel Image Optimizer - Optimize Images, Convert WebP & AVIF, reSmush.it : The original free image compressor and optimizer plugin, Resize Image After Upload, reGenerate Thumbnails Advanced, WP SVG Images, ShortPixel Adaptive Images - WebP, AVIF, CDN, Image Optimization, FastPixel Cache - Optimize Page Speed: Compress Images, Minify, Clean Database & CDN, ShortPixel AI Alt Text Generator

Questions

Is Enable Media Replace still maintained?

Yes. Last release 26 Oct 2026, 8 releases in the last 24 months.

Who owns Enable Media Replace, and has it changed hands?

No change recorded. Main committer petredobrescu since Mar 2020.

Was Enable Media Replace removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is Enable Media Replace safe?

12 known vulnerabilities, all fixed (latest in 4.2.3). Not on the exploited list.

Is the latest Enable Media Replace update safe to install?

No ownership change before 4.2.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue