CVE-2021-24610

MEDIUM

TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24610 has a selected CVSS score of 4.8 (medium); EIP currently links 1 catalogued exploit.

Description

The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

Translate Multilingual sites – TranslatePress

CVE List2.0.9 to < 2.0.9affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin TranslatePress 2.0.8 - Stored Cross-Site Scripting (XSS) (Authenticated)ExploitDB exploitby Nosa ShandyNot analyzed1 file
ExploitDB
PoC details

References

3