CVE-2020-13641

An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress

High · published May 28, 2020

CVSS v3.0
8.8
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00809 · 56.4th percentile
Published
2020-05-28T03:11Z
EPSS history
Timeline
  • 28 MAY 03:11Z
    An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress
    cvelistv5