CVE-2022-2311

The vulnerability CVE-2022-2311 affects the WordPress Find and Replace All plugin prior to version 1.3, where parameters from the plugin’s settings page are not properly sanitized/escaped before being echoed to the user, enabling a reflected Cross-Site Scripting (XSS) attack. The issue is documen...

CVE-2022-3850

CVE-2022-3850 concerns the Find and Replace All WordPress plugin (versions prior to 1.3). The root cause is missing CSRF protection when performing a string replacement, enabling a CSRF attack that can cause a logged-in administrator to replace arbitrary strings in database tables. Reported detai...