Skip to content
Sign in
5.4 Medium

CVE-2026-3369 The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting…

Description

The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded image title in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products and versions

Product Affected versions Fixed in
Better Find and Replace – AI-Powered Suggestions 1.7 earliest → 1.7.9 No fix stated

Other CVEs of Better Find and Replace – AI-Powered Suggestions

The 3 CVEs of Better Find and Replace – AI-Powered Suggestions →
CVE-2025-9334 The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all… 8.8 High CVE-2025-12360 The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to… 4.3 Medium
Track this CVE