Search & Replace
Search & Replace has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 8.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 2 disclosures.
The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (50%). Other recurring categories include SQL Injection.
Every one of the 2 issues recorded for Search & Replace has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Search & Replace is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.5.10.
CVE-2024-38759Search & Replace <= 3.2.2 - Unauthenticated PHP Object Injection
Read the full analysisVulnerability Records

Search & Replace
Author
WP Media
With Search & Replace you can search for everything and replace this with everything but before you do this you can easily create a simple database backup and restore it. For avoiding problem please keep in mind that this plugin search and replace strictly what is specified in “Replace With”. Common error example: Search For: http://web.com/wordpress/ Replace With: http://neuweb.com/wordpress The url become something like: http://neuweb.com/wordpresscontent/… Correct “Replace with”: Search For: http://web.com/wordpress/ Replace With: http://neuweb.com/wordpress/ The url become something like: http://neuweb.com/wordpress/content/… We have implemented special features! The first one is “Replace a Domain / URL” that is useful for a quick and simple transfer or a migration of a WordPress site. The second feature is full support for serialized data. There are a lot more features – check them out! 🙂 Our goal with this plugin is to give you a good solution for manipulating your data for both Developers and Users of WordPress. Note: This plugin requires PHP 5.6 or higher to be activated. Checkout our GitHub Repository Features Search & replace data in your WordPress database Change domain/URL of WordPress installation Handle serialized data Choose dry run or download SQL file Change table prefix Backup & restore your database WordPress Multisite support Localized and ready for your own language Crafted by WP Media Made by WP Media. Donation? You want to donate – we prefer a positive review, not more.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C