Cozmoslabs Translatepress vulnerabilities

CVE-2022-3141 [HIGH] CWE-89 CVE-2022-3141: The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

CVE-2025-58592 [HIGH] CWE-502 CVE-2025-58592: Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilin Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.

CVE-2021-24610 [MEDIUM] CWE-79 CVE-2021-24610: The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the tra The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.

CVE-2025-30773 [HIGH] CWE-502 CVE-2025-30773: Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilin Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.