plugin

Find And Replace All Vulnerabilities

6 known security issues reported for the Find And Replace All WordPress plugin. Most recent disclosed Nov 28, 2022.

2 high 1 medium

Running Find And Replace All on your site? Check whether your installed version is affected.

Scan your site free

Find and Replace All [find-and-replace-all] < 1.3 (closed)

unknown

[en] The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.

Affected:
up to 1.3
Fixed in:
1.3
Disclosed:
Nov 28, 2022

CVE-2022-2311 on NVD →

Find and Replace All [find-and-replace-all] <= 1.3 (unfixed + closed)

unknown

[en] The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack

Affected:
up to 1.3
Fix:
No patched version reported
Disclosed:
Nov 28, 2022

CVE-2022-3850 on NVD →

Find and Replace All <= 1.3 - Cross-Site Request Forgery to Arbitrary Content Replacement

high

The Find and Replace All plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3. This is due to missing or incorrect nonce validation when performing a search. This makes it possible for unauthenticated attackers to replace arbitrary content on the site via forged request...

CVSS:
8.8
Affected:
up to 1.3
Fix:
No patched version reported
Disclosed:
Nov 4, 2022

CVE-2022-3850 on NVD →

Find and Replace All <= 1.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

high

The Find and Replace All plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3. This is due to missing or incorrect nonce validation when performing a search. This makes it possible for unauthenticated attackers to inject malicious JavaScript via forged request granted t...

CVSS:
8.8
Affected:
up to 1.3
Fix:
No patched version reported
Disclosed:
Nov 4, 2022

CVE-2022-2311 on NVD →

Find and Replace All <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

medium

The Find and Replace All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘findstr’ and 'replacestr' parameters in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissi...

CVSS:
5.5
Affected:
1.2 – 1.2
Fixed in:
1.3
Disclosed:
Nov 2, 2022

Find and Replace All [find-and-replace-all] < 1.3 (closed)

unknown

The Find and Replace All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘findstr’ and 'replacestr' parameters in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissi...

Affected:
up to 1.3
Fixed in:
1.3
Disclosed:
Nov 2, 2022

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database