Wp Multilang Translation And Multilingual Plugin
Monthly
Stored cross-site scripting in the WP Multilang translation and multilingual plugin for WordPress (all versions up to and including 2.4.31) lets an authenticated attacker holding Contributor-level capabilities or higher inject arbitrary JavaScript into post content, which then executes in the browser of any user - including administrators - who views the affected page. The flaw is rated moderate severity at CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and stems from insufficient input sanitization and output escaping (CWE-79); no public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and automatic trigger on page view make it attractive for privilege-escalation and session-theft chains. Sites that do not grant untrusted users Contributor access or that have upgraded beyond 2.4.31 are not exposed.
Stored cross-site scripting in the WP Multilang translation and multilingual plugin for WordPress (all versions up to and including 2.4.31) lets an authenticated attacker holding Contributor-level capabilities or higher inject arbitrary JavaScript into post content, which then executes in the browser of any user - including administrators - who views the affected page. The flaw is rated moderate severity at CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and stems from insufficient input sanitization and output escaping (CWE-79); no public exploit code and no confirmed active exploitation were identified at time of analysis, though the low attack complexity and automatic trigger on page view make it attractive for privilege-escalation and session-theft chains. Sites that do not grant untrusted users Contributor access or that have upgraded beyond 2.4.31 are not exposed.