CVE-2020-13641

An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.

• CWE-352

• https://wordpress.org/plugins/real-time-find-and-replace/#developersRelease Notes, Third Party Advisory
• https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-patched-in-real-time-find-and-replace-plugin/Exploit, Third Party Advisory
• https://wordpress.org/plugins/real-time-find-and-replace/#developersRelease Notes, Third Party Advisory
• https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-patched-in-real-time-find-and-replace-plugin/Exploit, Third Party Advisory

Published

May 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13634In Windows Master (aka Windows Optimization Master) 7.99.13.…7.8
• CVE-2020-13637An issue was discovered in the stashcat app through 3.9.2 fo…7.5
• CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has a…9.8
• CVE-2020-13639A stored XSS vulnerability was discovered in the ECT Provide…6.1
• CVE-2020-1364A denial of service vulnerability exists in the way that the…7.1
• CVE-2020-13640A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 …9.8
• CVE-2020-13642An issue was discovered in the SiteOrigin Page Builder plugi…8.8
• CVE-2020-13643An issue was discovered in the SiteOrigin Page Builder plugi…8.8
• CVE-2020-13644An issue was discovered in the Accordion plugin before 2.2.9…5.4
• CVE-2020-13645In GNOME glib-networking through 2.64.2, the implementation …6.5
• CVE-2020-13646In Cheetah free WiFi 5.1, the driver file (liebaonat.sys) al…7.8
• CVE-2020-13649parser/js/js-scanner.c in JerryScript 2.2.0 mishandles error…7.5