Transliterator Multilingual And Multi Script Text Conversion
Monthly
Stored cross-site scripting (XSS) in the Transliterator WordPress plugin (versions up to and including 2.5.8) allows unauthenticated attackers to inject arbitrary web scripts into comment content, which execute when a user views the affected page. The flaw exists because the plugin's shortcode markers and predictable {rstr_keep} placeholder are not stripped, letting payloads composed of WordPress core kses-allowed tags (a[title] and code) bypass comment sanitization and later expand into executable script. Sites with the plugin active and public comments enabled are at risk; no public exploit has been identified at time of analysis. The CVSS score is 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with scope change.
Stored cross-site scripting (XSS) in the Transliterator WordPress plugin (versions up to and including 2.5.8) allows unauthenticated attackers to inject arbitrary web scripts into comment content, which execute when a user views the affected page. The flaw exists because the plugin's shortcode markers and predictable {rstr_keep} placeholder are not stripped, letting payloads composed of WordPress core kses-allowed tags (a[title] and code) bypass comment sanitization and later expand into executable script. Sites with the plugin active and public comments enabled are at risk; no public exploit has been identified at time of analysis. The CVSS score is 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with scope change.