CVE-2023-4502

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

4.8MEDIUM

EPSS

0.1%

top 75.23%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Unknown Translate Wordpress With Gtranslate Gtranslate Translate Wordpress With Gtranslate

Timeline

PublishedSep 25

Description

The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/translate_wordpress_with_gtranslate< 3.0.4

▶NVDgtranslate/translate_wordpress_with_gtranslate< 3.0.4

🔴Vulnerability Details

GHSA

GHSA-m4jh-qqmf-7jg2: The Translate WordPress with GTranslate WordPress plugin before 3↗2023-09-25

▶

CVEList

Translate WordPress with GTranslate < 3.0.4 - Admin+ Stored XSS↗2023-09-25

▶