Enable Media Replace

The newest reviews mix real praise with real complaints, an unresolved Bricks Builder conflict and SiteGround caching clashes, a clear step down from the nearly all five-star run before them.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

407 searches this plugin appeared in over the last 90 days, 20 listed. 335 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 48% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 4.1 years ago; the previous band took 19 months to cross, which places it about 90% of the way through.

1. ★★★★★ tovapee

   4mo ago

   I made a ton of websites, in any single one of them the client wants to replace an image without needing to replace it in every page its being use, instead of having to drag them to ftp, this comes in hand so good, I don’t understand why this is not already in wordpress by default, should be

   Read on wp.org ↗
2. ★★★★★ Dawson Woods

   5mo ago

   I’ve gotten this plugin to work exactly once in over a year’s worth of time and attempts. I think it’s clash with SiteGround’s caching or something, and to be fair SiteGround is annoying aggressive about caching at all times even when you turn off everything. Putting my site in development mode, turning off NGINX direct delivery, dynamic cache, and memcache, and then purging all caches at all the different spots both from the backend and the front end, and still images are unchanged. I decided I would give up on trying to use this plugin. Too bad cause it’d great for replacing images in my employee’s e-mail signatures when they get new headshots and things like that where I have less control, but alas I will survive.

   Read on wp.org ↗
3. ★★★★★ Klaus Wilde

   8mo ago

   The best tool ever and still free. It’s not needed all the time, but kudos to the developers anyway

   Read on wp.org ↗
4. ★★★★★ platinumshore

   11mo ago

   might be useful for bulk changing images within the media library, but not of any use when trying to change an image via the post editor.. a nice replace option would be wonderful.. but as it is not much use for myself on single posts – using latest version of wordpress which i think is 6.8.3 Edited.. damn.. just found out that the images i was trying to change were set for some reason set as ‘custom urls’ despite been in the media library (maybe due to using the auto insert plugin from content from another website?), if set directly to the media library then a replace option in latest wordpress automatically appears anyway.. my ERROR. changed the star rating to 5/5 for just batch editing in the media library cuz latest wordpress if an image is properly set to the media library offers a replace option anyway.. This topic was modified 7 months, 4 weeks ago by platinumshore. This topic was modified 7 months, 4 weeks ago by platinumshore.

   Read on wp.org ↗
5. ★★★★★ Ferdy S

   12mo ago

   very useful when you only need to change files

   Read on wp.org ↗
6. ★★★★★ Lbch

   1.1y ago

   The plugin has a major integration issue with Bricks Builder, that will potentially break pages.This issue has been acknowledged but is still not fixed after more than a year.For more information check:…/support/topic/replace-svg-files/…/support/topic/bricks-builder-compatibility-still-not-fixed/Or search the Bricks Builder support forum.

   Read on wp.org ↗
7. ★★★★★ jonathanedwardmann

   1.4y ago

   Easy to set up and use, thanks for a terrific plugin!

   Read on wp.org ↗
8. ★★★★★ myracat

   1.5y ago

   Finding this plugin was basically the impetus for switching our support center to a WordPress setup. We have to update screenshots all the time in multiple locations, so this plugin means we just update the one image from the media library. HUGE time saver and it makes it really easy 🙂

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.2.2 Release date: June 28, 2026 * Fix: A potential stored XSS via the display name has been fixed, following the responsible disclosure from the PatchStack team; * Fix: A fatal error was thrown in a very specific edge case; 4.2.2
2. — Version 4.2.1 Release date: June 24, 2026 * Compat: Updated the integration with Breakdance builder to also work with the upcoming 2.8.0 version. 4.2.1
3. — Version 4.2.0 Release date: June 17, 2026 * New: Updated the plugin design and user interface; * New: Added hooks/filters to programmatically select the default replacement method; * New: Added cache plugin integrations for FastPixel, 4.2.0
4. — Version 4.1.9 Release date: April 22, 2026 * Fix: open_basedir warnings should be gone now for more restrictive hosts; * Fix: Stored Cross-Site Scripting vulnerability via the ‘location_dir’ parameter, responsibly disclosed by the Wor 4.1.9
5. — Version 4.1.8 Release date: March 3, 2026 * Fix: Unauthorized modification and deletion of media files vulnerability responsibly disclosed by the WordFence team; * Fix: The plugin works for RTL languages now; * Fix: Textdomain modules 4.1.8
6. — Version 4.1.7 Release date: October 2, 2025 * Fix: A potential “Cross-Site Scripting” vulnerability has been patched, responsibly disclosed by the WordFence team; * Fix: Corrected a few text typos. 4.1.7

All 10 disclosed vulnerabilities are patched in the current version (4.2.3). Sites still on an older version should update.

1. Patched Medium · 4.3 Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow ↗
   2026-10-27 CVE-2026-85655 Missing Authorization Affects <= 4.2.2 Patched in 4.2.3
2. Patched Medium · 4.4 Enable Media Replace <= 4.2.1 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
   2026-07-01 CVE-2026-57722 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.1 Patched in 4.2.2
3. Patched Medium · 6.4 Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter ↗
   2026-06-08 CVE-2026-5714 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.8 Patched in 4.1.9
4. Patched Medium · 5.4 Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace ↗
   2026-03-03 CVE-2026-2732 Missing Authorization Affects <= 4.1.7 Patched in 4.1.8
5. Patched Medium · 6.4 Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode ↗
   2025-10-10 CVE-2025-9496 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.6 Patched in 4.1.7
6. Patched Medium · 6.1 Enable Media Replace <= 4.1.5 - Reflected Cross-Site Scripting ↗
   2025-04-01 CVE-2025-31081 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.5 Patched in 4.1.6
7. Patched Medium · 4.7 Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting ↗
   2023-12-18 CVE-2023-6737 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.4 Patched in 4.1.5
8. Patched Medium · 6.6 Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection ↗
   2023-09-14 CVE-2023-4643 Deserialization of Untrusted Data Affects < 4.1.3 Patched in 4.1.3
9. Patched High · 8.8 Enable Media Replace <= 4.0.1 - Authenticated (Author+) Arbitrary File Upload ↗
   2023-01-17 CVE-2023-0255 Unrestricted Upload of File with Dangerous Type Affects <= 4.0.1 Patched in 4.0.2
10. Patched Medium · 6.8 Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal ↗
    2022-09-14 CVE-2022-2554 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.6.3 Patched in 4.0.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 55 languages, 12 at 90% or more

Plus 31 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2022-09-28 500K+ → 600K+ up after 574 days in tier
2. 2021-03-03 400K+ → 500K+ up after 504 days in tier
3. 2019-10-16 300K+ → 400K+ up after 563 days in tier
4. 2018-04-01 200K+ → 300K+ up after 586 days in tier
5. 2016-08-23 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Enable Media Replace into a readme, a review or a deck. It updates itself.

Enable Media Replace: 600K+ active installs, 4.4★ (302 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/enable-media-replace