Skip to content
Sign in
8.8 High

CVE-2025-9334 The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all…

Description

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions.

Affected products and versions

Product Affected versions Fixed in
Better Find and Replace – AI-Powered Suggestions 1.7 earliest → 1.7.7 No fix stated

Other CVEs of Better Find and Replace – AI-Powered Suggestions

The 3 CVEs of Better Find and Replace – AI-Powered Suggestions →
CVE-2026-3369 The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting… 5.4 Medium CVE-2025-12360 The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to… 4.3 Medium
Track this CVE