CVE-2025-10313: WordPress Find And Replace XSS Vulnerability

CVE-2025-10313 Overview

CVE-2025-10313 affects the Find And Replace Content plugin for WordPress in all versions up to and including 1.1. The vulnerability stems from a missing capability check on the far_admin_ajax_fun() function. Unauthenticated attackers can inject arbitrary web scripts and replace site content without any authentication. The flaw enables stored Cross-Site Scripting (XSS) and arbitrary content replacement, which attackers can leverage for privilege escalation and malicious redirects.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages and overwrite arbitrary site content, enabling session theft, malicious redirects, and full administrator account takeover.

Affected Products

Find And Replace Content plugin for WordPress, versions up to and including 1.1
WordPress sites with the plugin active and exposed admin-ajax.php endpoint
Any environment running the unpatched plugin regardless of WordPress core version

Discovery Timeline

2025-10-15 - CVE-2025-10313 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-10313

Vulnerability Analysis

The Find And Replace Content plugin registers the far_admin_ajax_fun() handler through WordPress AJAX hooks. The handler accepts find-and-replace input and applies it across plugin-managed content. The function lacks both a capability check and a nonce verification, classified as Missing Authorization [CWE-862]. Any visitor can invoke the action by sending a POST request to admin-ajax.php with the registered action name.

Because the handler stores attacker-supplied strings that later render in administrator and visitor contexts, injected payloads execute as stored Cross-Site Scripting. The same primitive permits arbitrary content replacement across pages the plugin manages. An attacker can rewrite legitimate content with phishing payloads, SEO spam, or redirect scripts.

Root Cause

The far_admin_ajax_fun() callback is registered under the wp_ajax_nopriv_ hook family, exposing it to unauthenticated users. The function omits current_user_can() and check_ajax_referer() calls. WordPress treats the request as authorized solely because the action is registered, and the plugin writes user-supplied input directly to persistent storage without sanitization.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted POST request to /wp-admin/admin-ajax.php specifying the plugin action and replacement payload. The injected JavaScript persists in the database and executes whenever an administrator views affected pages. Session cookies, CSRF tokens, and administrative actions become available to the attacker, completing the path to privilege escalation. See the Wordfence Vulnerability Report and WordPress Plugin Code for the vulnerable handler source.

Detection Methods for CVE-2025-10313

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing the plugin action handler
Unexpected <script> tags, iframe elements, or external redirect URLs embedded in post and page content
Modifications to plugin-managed content lacking a corresponding administrator session in WordPress audit logs
New outbound traffic from administrator browsers to suspicious domains following content views

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php with the far_admin_ajax_fun action originating from unauthenticated sessions
Run integrity checks against wp_posts content to identify unexpected string replacements or injected HTML
Alert on stored content containing JavaScript event handlers (onerror=, onload=) or document.location redirect patterns

Monitoring Recommendations

Enable WordPress audit logging to capture content changes with originating user and IP context
Monitor administrator browser sessions for unexpected script execution or cross-origin requests
Track plugin file integrity and database content drift through a file integrity monitoring solution

How to Mitigate CVE-2025-10313

Immediate Actions Required

Deactivate and remove the Find And Replace Content plugin until a patched release is published
Audit all WordPress posts and pages for injected scripts, redirects, or unauthorized content replacements
Force a password reset for all administrator and editor accounts and invalidate active sessions
Review recently created users and scheduled tasks (wp_options, wp_cron) for backdoor persistence

Patch Information

No fixed version is identified in the available advisory data. The vulnerability affects all versions up to and including 1.1. Consult the WordPress Plugin Overview page for the latest release status before reinstalling.

Workarounds

Block unauthenticated POST requests to admin-ajax.php referencing the vulnerable action at the web application firewall layer
Restrict access to /wp-admin/ paths by IP allowlist where operational requirements permit
Replace the plugin with a maintained alternative that enforces capability and nonce checks on AJAX handlers

bash

# Example WAF rule to block the vulnerable AJAX action
# ModSecurity rule blocking unauthenticated calls to far_admin_ajax_fun
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1010313,\
    msg:'Block CVE-2025-10313 Find And Replace Content exploit'"
    SecRule ARGS:action "@streq far_admin_ajax_fun" \
        "chain"
        SecRule &REQUEST_COOKIES:wordpress_logged_in_* "@eq 0"