Skip to content
Sign in
Not rated

CVE-2021-24610 The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings

Description

The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.

Affected products and versions

Product Affected versions Fixed in
Translate Multilingual sites – TranslatePress 2.0 earliest → < 2.0.9 2.0.9

Other CVEs of Translate Multilingual sites – TranslatePress

The 2 CVEs of Translate Multilingual sites – TranslatePress →
CVE-2022-3141 The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection Not rated
Track this CVE