CVE-2022-2311: The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its set

Q: How do I fix CVE-2022-2311?

find and replace all: upgrade to 1.3. Exact commands for each OS are on this page.

Q: Is CVE-2022-2311 being exploited?

CVE-2022-2311 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2022-2311 affect?

CVE-2022-2311 affects find and replace all. Severity is medium (CVSS 6.1). The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.

Q: How urgent is CVE-2022-2311?

Priority 37/100. Public exploit reference

Routine

MEDIUM 6.1UPGRADE

CVE-2022-2311 is a medium-severity flaw (CVSS 6.1) affecting find and replace all. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.5% (top 56%)
CISA exploited list	No
Published	2022-11-28
Last modified	2026-06-17

Publisher (CNA): WPScan · Vendor: find and replace all project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-11-28 14:15 UTCPublished CVE record published
2026-06-17 04:41 UTCUpdated Record last modified

find and replace all project find and replace all UPGRADE

Affected: < 1.3

Fixed in: 1.3

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy find-and-replace-all || rpm -q find-and-replace-all || find-and-replace-all --version

2. UPGRADE to 1.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade find-and-replace-all

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade find-and-replace-all

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-2311?

find and replace all: upgrade to 1.3. Exact commands for each OS are on this page.

Is CVE-2022-2311 being exploited?

CVE-2022-2311 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-2311 affect?

CVE-2022-2311 affects find and replace all. Severity is medium (CVSS 6.1). The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.

How urgent is CVE-2022-2311?

Priority 37/100. Public exploit reference

Software pages

WordPress vulnerabilities

Related CVEs

CVE-2022-3850 MEDIUM 4.3 UPGRADE The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which cou

References

← Back to latest CVEs