Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2025-53466

WordPress Better Find and Replace Plugin <= 1.7.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Stored XSS.This issue affects Better Find and Replace: from n/a through <= 1.7.6.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Codesolz Wordpress
Products
Better Find And Replace Wordpress
CVE-2025-24734

WordPress Better Find and Replace plugin <= 1.6.7 - Privilege Escalation vulnerability

Missing Authorization vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Privilege Escalation.This issue affects Better Find and Replace: from n/a through <= 1.6.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Codesolz Wordpress
Products
Better Find And Replace Wordpress
CVE-2026-3369

Better Find and Replace – AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded image title in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Codesolz Wordpress
Products
Better Find And Replace – Ai-powered Suggestions Wordpress
CVE-2025-9334

Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Codesolz Wordpress
Products
Better Find And Replace Wordpress
CVE-2025-12360

Better Find and Replace <= 1.7.7 - Missing Authorization

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Codesolz Wordpress
Products
Better Find And Replace Wordpress
CVE-2024-39636

WordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Codesolz
Products
Better Find And Replace
CVE-2023-25460

WordPress Easy Ad Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodeSolz Easy Ad Manager plugin <= 1.0.0 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Codesolz
Products
Easy Ad Manager
CVE-2022-1472

Better Find and Replace < 1.3.6 - Admin+ SQLi

The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed
Vendors
Codesolz
Products
Better Find And Replace
CVE-2021-24676

Better Find and Replace < 1.2.9 - Reflected Cross-Site Scripting

The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Codesolz
Products
Better Find And Replace