CVE-2022-2311

Find and Replace All < 1.3 - Reflected Cross Site Scripting

The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.

Affected

Find and Replace All

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.51% chance of exploitation in the next 30 days, 42nd percentile

Published

2022-11-28

Updated

2025-04-23

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/287a14dc-d1fc-481d-84af-7eb172dc68c9

References

• CVE Record
• NVD entry