The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
References
Link | Resource |
---|---|
http://packetstormsecurity.com/files/164306/WordPress-TranslatePress-2.0.8-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
https://wpscan.com/vulnerability/b87fcc2f-c2eb-4e23-9757-d1c590f26d3f | Exploit Third Party Advisory |
Configurations
History
04 Oct 2021, 20:14
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:cozmoslabs:translatepress:*:*:*:*:*:wordpress:*:* | |
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 4.8 |
References | (MISC) http://packetstormsecurity.com/files/164306/WordPress-TranslatePress-2.0.8-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry | |
References | (MISC) https://wpscan.com/vulnerability/b87fcc2f-c2eb-4e23-9757-d1c590f26d3f - Exploit, Third Party Advisory |
28 Sep 2021, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
27 Sep 2021, 17:01
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-09-27 16:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-24610
Mitre link : CVE-2021-24610
CVE.ORG link : CVE-2021-24610
JSON object : View
Products Affected
cozmoslabs
- translatepress
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')