CVE-2022-2311

Find and Replace All < 1.3 - Reflected Cross Site Scripting

CVSS 6.1 MEDIUMEPSS 0.5%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

28 Nov 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Unknown · Find and Replace All

References

https://wpscan.com/vulnerability/287a14dc-d1fc-481d-84af-7eb172dc68c9