Vulnerabilities

TI-2024-25993 CVE-2024-38759 · GHSA-36m8-m5cm-hfhr

WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability

MEDIUM 42

Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00307 Published 2024-07-22 No fix listed CWE-502

TI-2024-03858 CVE-2024-4145 · GHSA-q492-8r5j-853q

Search & Replace < 3.2.2 - Admin+ SQL injection

HIGH 65

The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a multi-site network).

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00444 Published 2024-06-13 Fixed in 3.2.2 CWE-89

Vulnerabilities

Filters

WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability

Search & Replace < 3.2.2 - Admin+ SQL injection