Not rated
CVE-2021-24911 The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from…
Description
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Transposh WordPress Translation 1.0 | earliest → < 1.0.8 | 1.0.8 |
Other CVEs of Transposh WordPress Translation
The 6 CVEs of Transposh WordPress Translation →
CVE-2022-25812
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could…
Not rated
CVE-2022-25811
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby…
Not rated
CVE-2022-25810
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has…
Not rated
CVE-2021-24912
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX…
Not rated