Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · real-time-auto-find-and-replace
Better Find and Replace
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Apr 16, 2026Better Find and Replace – AI-Powered Suggestions: Stored Cross-Site ScriptingCVE-2026-3369 · affects up to 1.7.9 · reported by WordfenceMedium 5.4
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded image title in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Nov 8, 2025Better Find and Replace – AI-Powered Suggestions: Limited Code InjectionCVE-2025-9334 · affects up to 1.7.7 · reported by WordfenceHigh 8.8
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 1.7.7. This is due to insufficient input validation and restriction on the 'rtafar_ajax' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to call arbitrary plugin functions and execute code within those functions.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025Better Find and Replace – AI-Powered Suggestions: Unauthorized API usageCVE-2025-12360 · affects up to 1.7.7 · reported by WordfenceMedium 4.3
The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access, to trigger OpenAI API key usage resulting in quota consumption potentially incurring cost.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2025Better Find and Replace: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-53466 · affects up to 1.7.6 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Stored XSS.This issue affects Better Find and Replace: from n/a through <= 1.7.6.
Jan 27, 2025Better Find and Replace: Missing AuthorizationCVE-2025-24734 · affects up to 1.6.7 · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Privilege Escalation.This issue affects Better Find and Replace: from n/a through <= 1.6.7.
Aug 1, 2024Better Find and Replace: Deserialization of Untrusted DataCVE-2024-39636 · affects up to 1.6.1 · reported by PatchstackHigh 8.3
Deserialization of Untrusted Data vulnerability in CodeSolz Better Find and Replace.This issue affects Better Find and Replace: from n/a through 1.6.1.
Jun 20, 2022Better Find and Replace: Does not properly sanitiseCVE-2022-1472 · fixed in 1.3.6 · reported by WPScanHigh 7.2
The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statement, leading to an SQL Injection
Oct 4, 2021Better Find and Replace: Does not escape the 's' GET parameter before outputting back in the All Masking Rules pageCVE-2021-24676 · fixed in 1.2.9 · reported by WPScanMedium 6.1
The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.