CVE-2021-24912CWE-352CWE-79

Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS

published August 22, 2022

CVSS
—
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00348 · 27.2th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-08-22T14:56Z
EPSS history
Timeline
  • 22 AUG 14:56Z
    Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS
    cvelistv5