Non notée
CVE-2021-24911 The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from…
Description
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Transposh WordPress Translation 1.0 | premières → < 1.0.8 | 1.0.8 |
Autres CVE de Transposh WordPress Translation
Les 6 CVE de Transposh WordPress Translation →
CVE-2022-25812
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could…
Non notée
CVE-2022-25811
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby…
Non notée
CVE-2022-25810
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has…
Non notée
CVE-2021-24912
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX…
Non notée