CVE-2021-24911

Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.

Affected

Transposh WordPress Translation

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.69% chance of exploitation in the next 30 days, 52nd percentile

Published

2022-08-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/bd88be21-0cfc-46bd-b78a-23efc4868a55

References

• CVE Record
• NVD entry