CVE-2021-24912

CWE-79 — Cross-site Scripting (XSS)CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 56.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Transposh Wordpress TranslationTransposh Transposh Wordpress Translation
Timeline
PublishedAug 22
Latest updateAug 23

Description

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/transposh_wordpress_translation1.0.8 — 1.0.8

🔴Vulnerability Details

2
GHSA
GHSA-76qx-g957-hwpc: The Transposh WordPress Translation WordPress plugin before 1↗2022-08-23
▶
CVEList
Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS↗2022-08-22
▶
CVE-2021-24912 (MEDIUM CVSS 5.4) | The Transposh WordPress Translation | cvebase.io