CVE-2026-3369 is a stored cross-site scripting vulnerability in the Better Find and Replace – AI-Powered Suggestions WordPress plugin by codesolz. The issue occurs due to improper neutralization of input during web page generation, specifically in the handling of uploaded image titles. Authenticated users with author-level access or higher can inject arbitrary web scripts that execute when the injected page is accessed. The vulnerability affects versions up to and including 1.7.9. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges and user interaction.

An attacker with author-level or higher privileges can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or modification of page content. There is no direct impact on availability. The vulnerability requires authenticated access and user interaction to trigger the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling or removing the affected plugin if possible. Monitor for updates from codesolz regarding patches or mitigations. Avoid interacting with untrusted content uploaded via this plugin.