CVE-2025-10313: Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the faradminajaxfun() function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10313?
CVE-2025-10313 is classified as a high severity vulnerability due to the potential for unauthorized stored cross-site scripting and arbitrary content replacement.
How do I fix CVE-2025-10313?
To fix CVE-2025-10313, update the Find And Replace plugin for WordPress to version 1.2 or later, which includes the necessary capability checks.
Who is affected by CVE-2025-10313?
CVE-2025-10313 affects all versions of the Find And Replace plugin for WordPress up to and including version 1.1.
What types of attacks are possible with CVE-2025-10313?
Attackers can exploit CVE-2025-10313 to execute unauthorized scripts and replace content on affected WordPress sites.
What component of the plugin is vulnerable in CVE-2025-10313?
The vulnerability in CVE-2025-10313 is due to a missing capability check in the far_admin_ajax_fun() function within the Find And Replace plugin.