Translate Wordpress With Gtranslate
Monthly
Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.