Unknown Transposh Wordpress Translation vulnerabilities
6 known vulnerabilities affecting unknown/transposh_wordpress_translation.
Total CVEs
6
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM4
Vulnerabilities
Page 1 of 1
CVE-2022-25811HIGHCVSS 7.2≥ 1.0.8, ≤ 1.0.82022-08-22
CVE-2022-25811 [HIGH] CWE-89 CVE-2022-25811: The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
cvelistv5nvd
CVE-2022-25812HIGHCVSS 7.2≥ 1.0.8, < 1.0.82022-08-22
CVE-2022-25812 [HIGH] CWE-94 CVE-2022-25812: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settin
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE
cvelistv5nvd
CVE-2022-25810MEDIUMCVSS 6.5≥ 1.0.8, ≤ 1.0.82022-08-22
CVE-2022-25810 [MEDIUM] CWE-862 CVE-2022-25810: The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive act
The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations an
cvelistv5nvd
CVE-2021-24910MEDIUMCVSS 6.1PoC≥ 1.0.8, < 1.0.82022-08-22
CVE-2021-24910 [MEDIUM] CWE-79 CVE-2021-24910: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is installed) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
cvelistv5nvd
CVE-2021-24911MEDIUMCVSS 5.4≥ 1.0.8, < 1.0.82022-08-22
CVE-2021-24911 [MEDIUM] CWE-79 CVE-2021-24911: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the t
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
cvelistv5nvd
CVE-2021-24912MEDIUMCVSS 5.4≥ 1.0.8, < 1.0.82022-08-22
CVE-2021-24912 [MEDIUM] CWE-79 CVE-2021-24912: The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a log
cvelistv5nvd