Cm On Demand Search And Replace Vulnerabilities

[en] Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.4.

Affected:

up to 1.5.4

Fix:

No patched version reported

Disclosed:

Dec 16, 2025

CVE-2025-54045 on NVD →

The CM On Demand Search And Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web...

CVSS:

4.4

Affected:

up to 1.5.2

Fixed in:

1.5.3

Disclosed:

Aug 14, 2025

CVE-2025-54727 on NVD →

The CM Search And Replace – Optimize content edits with a powerful search and replace tool plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attacker...

CVSS:

4.3

Affected:

up to 1.5.2

Fixed in:

1.5.3

Disclosed:

Aug 14, 2025

CVE-2025-54728 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace allows Cross Site Request Forgery. This issue affects CM On Demand Search And Replace: from n/a through 1.5.2.

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Aug 14, 2025

CVE-2025-54728 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace allows Stored XSS. This issue affects CM On Demand Search And Replace: from n/a through 1.5.2.

Affected:

up to 1.5.3

Fixed in:

1.5.3

Disclosed:

Aug 14, 2025

CVE-2025-54727 on NVD →

The CM On Demand Search And Replace plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.5.4

Fix:

No patched version reported

Disclosed:

Jun 30, 2025

CVE-2025-54045 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Email Registration Blacklist and Whitelist allows Reflected XSS. This issue affects CM Email Registration Blacklist and Whitelist: from n/a through 1.5.5.

Affected:

up to 1.4.5

Fixed in:

1.4.5

Disclosed:

Mar 3, 2025

CVE-2025-24694 on NVD →

[en] Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...

Affected:

up to 1.4.3

Fixed in:

1.4.3

Disclosed:

Nov 26, 2024

CVE-2024-11202 on NVD →

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...

CVSS:

6.1

Affected:

up to 1.4.2

Fixed in:

1.4.3

Disclosed:

Nov 25, 2024

CVE-2024-11202 on NVD →

The CM WordPress Search And Replace Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the 'cmodsar_settings' page. This makes it possible for unauthenticated attackers to reset the plugin's setting...

CVSS:

4.3

Affected:

up to 1.3.8

Fixed in:

1.3.9

Disclosed:

Jul 22, 2024

CVE-2024-5028 on NVD →

[en] The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Affected:

up to 1.3.9

Fixed in:

1.3.9

Disclosed:

Jul 13, 2024

CVE-2024-5028 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

Affected:

up to 1.3.1

Fixed in:

1.3.1

Disclosed:

Nov 22, 2023

CVE-2023-28749 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

Affected:

up to 1.3.1

Fixed in:

1.3.1

Disclosed:

Aug 18, 2023

CVE-2023-31228 on NVD →

The CM On Demand Search And Replace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on the ajaxUpdateReplacement, ajaxDeleteReplacement, and ajaxAddReplacement functions called via AJAX actions. This makes it possible for...

CVSS:

4.3

Affected:

up to 1.3.0

Fixed in:

1.3.1

Disclosed:

May 9, 2023

CVE-2023-28749 on NVD →

The CM On Demand Search And Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to i...

CVSS:

4.4

Affected:

up to 1.3.0

Fixed in:

1.3.1

Disclosed:

Apr 28, 2023

CVE-2023-31228 on NVD →