Codesolz
Monthly
Stored cross-site scripting in Better Find and Replace WordPress plugin (versions ≤1.7.9) allows authenticated attackers with Author-level privileges or above to inject arbitrary web scripts via the title field of uploaded images. The injected script executes in the browsers of any user who accesses a page containing the malicious image, potentially leading to session hijacking or phishing attacks. No active exploitation or public proof-of-concept is reported.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in Better Find and Replace WordPress plugin (versions ≤1.7.9) allows authenticated attackers with Author-level privileges or above to inject arbitrary web scripts via the title field of uploaded images. The injected script executes in the browsers of any user who accesses a page containing the malicious image, potentially leading to session hijacking or phishing attacks. No active exploitation or public proof-of-concept is reported.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.