Stored Cross-Site Scripting in Enable Media Replace Location Directory Field

Enable Media Replace up to and including 4.1.8 renders the 'location_dir' value into an HTML attribute on the media replace screen without escaping it. An authenticated attacker with Author-level access or above can break out of the attribute and inject arbitrary JavaScript, which then executes for any user who views the affected page. This...