Administrator compromise via nonce-free rule updates

Stored cross-site scripting in Real-Time Find and Replace before 4.0.2 allows remote attackers to inject JavaScript through forged requests. The far_options_page function accepts rule-update POST data without nonce verification and stores attacker-chosen replacements that execute when matching page content is rendered. Exploitation requires an administrator to submit the forged request; the injected script can steal session cookies, create an administrator account, redirect visitors, or alter site content.