Translate Wordpress With Weglot 2 0
Monthly
Stored cross-site scripting in the Weglot WordPress plugin before 6.4.3 lets unauthenticated attackers plant a payload that executes in the browser of anyone who views an affected page in a translated language. The flaw appears when Weglot rewrites links for translated content: it re-inserts URLs without escaping and reverses earlier encoding. Exploitation requires the site to have link rewriting/translation rendering active with at least one additional language and a victim to load the translated view; publicly available exploit code exists, and the issue is moderate priority rather than a critical fire-drill.
Stored cross-site scripting in the Weglot WordPress plugin before 6.4.3 lets unauthenticated attackers plant a payload that executes in the browser of anyone who views an affected page in a translated language. The flaw appears when Weglot rewrites links for translated content: it re-inserts URLs without escaping and reverses earlier encoding. Exploitation requires the site to have link rewriting/translation rendering active with at least one additional language and a victim to load the translated view; publicly available exploit code exists, and the issue is moderate priority rather than a critical fire-drill.