Enable Media Replace

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 48% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

The newest reviews mix real praise with real complaints, an unresolved Bricks Builder conflict and SiteGround caching clashes, a clear step down from the nearly all five-star run before them.

1. ★★★★★ tovapee

   1mo ago

   I made a ton of websites, in any single one of them the client wants to replace an image without needing to replace it in every page its being use, instead of having to drag them to ftp, this comes in hand so good, I don’t understand why this is not already in wordpress by default, should be

   Read on wp.org ↗
2. ★★★★★ Dawson Woods

   2mo ago

   I’ve gotten this plugin to work exactly once in over a year’s worth of time and attempts. I think it’s clash with SiteGround’s caching or something, and to be fair SiteGround is annoying aggressive about caching at all times even when you turn off everything. Putting my site in development mode, turning off NGINX direct delivery, dynamic cache, and memcache, and then purging all caches at all the different spots both from the backend and the front end, and still images are unchanged. I decided I would give up on trying to use this plugin. Too bad cause it’d great for replacing images in my employee’s e-mail signatures when they get new headshots and things like that where I have less control, but alas I will survive.

   Read on wp.org ↗
3. ★★★★★ Klaus Wilde

   6mo ago

   The best tool ever and still free. It’s not needed all the time, but kudos to the developers anyway

   Read on wp.org ↗
4. ★★★★★ platinumshore

   9mo ago

   might be useful for bulk changing images within the media library, but not of any use when trying to change an image via the post editor.. a nice replace option would be wonderful.. but as it is not much use for myself on single posts – using latest version of wordpress which i think is 6.8.3 Edited.. damn.. just found out that the images i was trying to change were set for some reason set as ‘custom urls’ despite been in the media library (maybe due to using the auto insert plugin from content from another website?), if set directly to the media library then a replace option in latest wordpress automatically appears anyway.. my ERROR. changed the star rating to 5/5 for just batch editing in the media library cuz latest wordpress if an image is properly set to the media library offers a replace option anyway.. This topic was modified 7 months, 4 weeks ago by platinumshore. This topic was modified 7 months, 4 weeks ago by platinumshore.

   Read on wp.org ↗
5. ★★★★★ Ferdy S

   9mo ago

   very useful when you only need to change files

   Read on wp.org ↗
6. ★★★★★ Lbch

   12mo ago

   The plugin has a major integration issue with Bricks Builder, that will potentially break pages.This issue has been acknowledged but is still not fixed after more than a year.For more information check:…/support/topic/replace-svg-files/…/support/topic/bricks-builder-compatibility-still-not-fixed/Or search the Bricks Builder support forum.

   Read on wp.org ↗
7. ★★★★★ jonathanedwardmann

   1.2y ago

   Easy to set up and use, thanks for a terrific plugin!

   Read on wp.org ↗
8. ★★★★★ myracat

   1.3y ago

   Finding this plugin was basically the impetus for switching our support center to a WordPress setup. We have to update screenshots all the time in multiple locations, so this plugin means we just update the one image from the media library. HUGE time saver and it makes it really easy 🙂

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.2.2 Release date: June 28, 2026 * Fix: A potential stored XSS via the display name has been fixed, following the responsible disclosure from the PatchStack team; * Fix: A fatal error was thrown in a very specific edge case; 4.2.2
2. — Version 4.2.1 Release date: June 24, 2026 * Compat: Updated the integration with Breakdance builder to also work with the upcoming 2.8.0 version. 4.2.1
3. — Version 4.2.0 Release date: June 17, 2026 * New: Updated the plugin design and user interface; * New: Added hooks/filters to programmatically select the default replacement method; * New: Added cache plugin integrations for FastPixel, 4.2.0
4. — Version 4.1.9 Release date: April 22, 2026 * Fix: open_basedir warnings should be gone now for more restrictive hosts; * Fix: Stored Cross-Site Scripting vulnerability via the ‘location_dir’ parameter, responsibly disclosed by the Wor 4.1.9
5. — Version 4.1.8 Release date: March 3, 2026 * Fix: Unauthorized modification and deletion of media files vulnerability responsibly disclosed by the WordFence team; * Fix: The plugin works for RTL languages now; * Fix: Textdomain modules 4.1.8
6. — Version 4.1.7 Release date: October 2, 2025 * Fix: A potential “Cross-Site Scripting” vulnerability has been patched, responsibly disclosed by the WordFence team; * Fix: Corrected a few text typos. 4.1.7

9 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.4 Enable Media Replace <= 4.2.1 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
   2026-07-01 CVE-2026-57722 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.2.1 Patched in 4.2.2
2. Medium · 6.4 Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter ↗
   2026-06-08 CVE-2026-5714 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.1.8 Patched in 4.1.9
3. Medium · 5.4 Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace ↗
   2026-03-03 CVE-2026-2732 Missing Authorization Affects <= 4.1.7 Patched in 4.1.8
4. Medium · 6.4 Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode ↗
   2025-10-10 CVE-2025-9496 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.1.6 Patched in 4.1.7
5. Medium · 6.1 Enable Media Replace <= 4.1.5 - Reflected Cross-Site Scripting ↗
   2025-04-01 CVE-2025-31081 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.1.5 Patched in 4.1.6
6. Medium · 4.7 Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting ↗
   2023-12-18 CVE-2023-6737 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.1.4 Patched in 4.1.5
7. Medium · 6.6 Enable Media Replace <= 4.1.2 - Authenticated(Author+) PHP Object Injection ↗
   2023-09-14 CVE-2023-4643 Deserialization of Untrusted Data Affects < 4.1.3 Patched in 4.1.3
8. High · 8.8 Enable Media Replace <= 4.0.1 - Authenticated (Author+) Arbitrary File Upload ↗
   2023-01-17 CVE-2023-0255 Unrestricted Upload of File with Dangerous Type Affects <= 4.0.1 Patched in 4.0.2
9. Medium · 6.8 Enable Media Replace <= 3.6.3 - Authenticated (Administrator+) Path Traversal ↗
   2022-09-14 CVE-2022-2554 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 3.6.3 Patched in 4.0.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 54 languages, 9 at 90% or more

Plus 30 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

No tier crossings observed yet.

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Easy Media Replace 1K+ installs · 3.9★ · 2 shared tags D
• Yatterukun — installs · 3.6★ · 2 shared tags D
• Search Regex 100K+ installs · 4.6★ · 1 shared tag A
• Search & Replace 100K+ installs · 4.3★ · 1 shared tag C
• Real-Time Find and Replace 70K+ installs · 4.4★ · 1 shared tag A
• Remove Footer Credit 70K+ installs · 4.6★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for Enable Media Replace into a readme, a review or a deck. It updates itself.

Enable Media Replace: 600K+ active installs, 4.4★ (302 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/enable-media-replace