Better Search Replace

The plugin’s AJAX handlers for database search and replace operations only verified CSRF nonce tokens but did not check user capabilities. This could allow authenticated users without the required privilege level to perform unauthorized search and replace operations on the WordPress database.

This vulnerability affects the following application versions:

• Better Search Replace 1.3.4
• Better Search Replace 1.4
• Better Search Replace 1.4.1
• Better Search Replace 1.4.2
• Better Search Replace 1.4.3
• Better Search Replace 1.4.4
• Better Search Replace 1.4.5
• Better Search Replace 1.4.6
• Better Search Replace 1.4.7
• Better Search Replace 1.4.9

The Better Search Replace plugin did not properly escape table names before rendering them in the HTML output of the search/replace report. This allowed an attacker to inject malicious JavaScript code via crafted table names, leading to a stored Cross-Site Scripting (XSS) vulnerability. Exploitation requires a user with access to manipulate database content or plugin inputs, and successful execution could result in the compromise of admin sessions or unauthorized actions within the WordPress dashboard.

This vulnerability affects the following application versions:

• Better Search Replace 1.3.4
• Better Search Replace 1.4
• Better Search Replace 1.4.1
• Better Search Replace 1.4.2
• Better Search Replace 1.4.3
• Better Search Replace 1.4.4
• Better Search Replace 1.4.5