The Find And Replace content for WordPress plugin is vulnerable to unauthorized stored cross‑site scripting and arbitrary content replacement. Missing capability checks in the far_admin_ajax_fun() function allow unauthenticated attackers to inject malicious scripts into posts or pages. Once injected, these scripts execute in the context of any user who views the content, enabling privilege escalation and malicious redirects.

Vulnerable versions of the Find And Replace content for WordPress plugin, authored by jankimoradiya, include all releases up to and including 1.1. Administrators or users with access to the plugin's dashboard may be able to exploit the flaw. The issue affects the plugin only; the core WordPress installation is not directly impacted.

With a CVSS score of 7.2, the flaw represents a high‑impact vulnerability. The EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of this analysis, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is inferred to be through the plugin's AJAX endpoint that lacks proper capability checks, allowing remote unauthenticated code injection.