Stored Cross-Site Scripting Vulnerability in Find And Replace Plugin by WordPress

CVE-2025-10313

What is CVE-2025-10313?

The Find And Replace content plugin for WordPress is susceptible to unauthorized stored cross-site scripting (XSS) and arbitrary content replacement. This vulnerability stems from a missing capability check in the far_admin_ajax_fun() function, present in all versions up to and including 1.1. As a result, unauthenticated attackers can exploit this flaw to inject arbitrary scripts into web pages, which may lead to privilege escalation and malicious redirects.

References