CVE-2021-24911

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.66% chance of exploitation in the next 30 days, 49th percentile

Published

2022-08-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/bd88be21-0cfc-46bd-b78a-23efc4868a55

References

• CVE Record
• NVD entry

Related

• CVE-2021-24910
• CVE-2021-24912
• CVE-2021-24909
• CVE-2021-24913
• CVE-2021-24908
• CVE-2021-24914