Auth bypass in Jankimoradiya Find And Replace Content For WordPress
CVE-2025-10313
The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the far_admin_ajax_fun() function in all versions up to, and including, 1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that can make privilege escalation and malicious redirects possible.
Vulnerability class: Broken Access Control
EPSS: 0.003 (18.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Jankimoradiya Find And Replace Content For Wordpress — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-10313?
- CVE-2025-10313 is a high-severity vulnerability in Jankimoradiya Find And Replace Content For WordPress, classified under Missing Authorization. CVSS score: 7.2/10. Published 2025-10-15.
- How severe is CVE-2025-10313?
- High severity. CVSS v3 base score is 7.2 out of 10.