The Better Search Replace plugin did not properly escape table names before rendering them in the HTML output of the search/replace report. This allowed an attacker to inject malicious JavaScript code via crafted table names, leading to a stored Cross-Site Scripting (XSS) vulnerability. Exploitation requires a user with access to manipulate database content or plugin inputs, and successful execution could result in the compromise of admin sessions or unauthorized actions within the WordPress dashboard.
This vulnerability affects the following application versions:
- Better Search Replace 1.3.4
- Better Search Replace 1.4
- Better Search Replace 1.4.1
- Better Search Replace 1.4.2
- Better Search Replace 1.4.3
- Better Search Replace 1.4.4
- Better Search Replace 1.4.5