Stored Cross-Site Scripting Vulnerability in Better Find and Replace Plugin for WordPress
CVE-2026-3369

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Better Find And Replace – Ai-powered Suggestions
Vendor
CVE Published:
16 April 2026

What is CVE-2026-3369?

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress has a vulnerability that allows authenticated attackers with author-level access or higher to exploit the insufficient input sanitization and output escaping. This risk is particularly serious as attackers can inject malicious scripts via the uploaded image titles. When a user accesses a page affected by such an injection, arbitrary scripts may execute, potentially compromising user data and site integrity.

Affected Version(s)

Better Find and Replace – AI-Powered Suggestions 0 <= 1.7.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3477632/real...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supanat Konprom
.