Headline

CVE-2021-24912

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scripting issue which will be executed in the context of a logged in admin

2 years ago

CVE

Open in Source

#xss #csrf #wordpress #auth

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.

2 years ago

CVE

Open in Source

#sql #xss #js #java #wordpress #php #auth

Transposh WordPress Translation 1.0.8.1 Cross Site Request Forgery

Transposh WordPress Translation versions 1.0.8.1 and below suffer from cross site request forgery vulnerabilities.

2 years ago

Packet Storm

Open in Source

#csrf #vulnerability #web #git #wordpress #php #acer #auth