CVE-2025-10313

🗓️ 15 Oct 2025 08:26:02Reported by WordfenceType

Unauthenticated stored XSS and content replacement in Find And Replace plugin up to version 1.1 due to missing capability check.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-10313	15 Oct 202511:33	–	circl
CNNVD	WordPress plugin Find And Replace content 安全漏洞	15 Oct 202500:00	–	cnnvd
CNVD	WordPress Find And Replace content plugin cross-site scripting vulnerability	21 Oct 202500:00	–	cnvd
Cvelist	CVE-2025-10313 Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting	15 Oct 202508:26	–	cvelist
EUVD	EUVD-2025-34541	15 Oct 202508:26	–	euvd
NVD	CVE-2025-10313	15 Oct 202509:15	–	nvd
Patchstack	WordPress Find And Replace content for WordPress plugin <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting vulnerability	15 Oct 202501:08	–	patchstack
RedhatCVE	CVE-2025-10313	16 Oct 202508:33	–	redhatcve
Vulnrichment	CVE-2025-10313 Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting	15 Oct 202508:26	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (October 13, 2025 to October 19, 2025)	23 Oct 202515:44	–	wordfence

Vulners

Node

jankimoradiya find_and_replace_content_for_wordpressRange≤1.1wordpress

[
  {
    "vendor": "jankimoradiya",
    "product": "Find And Replace content for WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c0469ece-6f5f-4774-8094-f7f67702a775
plugins	www.plugins.trac.wordpress.org/browser/find-and-replace-content/trunk/function.php
wordpress	www.wordpress.org/plugins/find-and-replace-content/

15 Apr 2026 00:35Current

4.6Medium risk

Vulners AI Score4.6

CVSS 3.17.2

EPSS0.00117

SSVC

CWE-862