Transposh WordPress Translation 1.0.7 Cross Site Scripting

`RCE Security Advisory  
https://www.rcesecurity.com  
  
  
1. ADVISORY INFORMATION  
=======================  
Product: Transposh WordPress Translation  
Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/  
Type: Cross-Site Scripting [CWE-79]  
Date found: 2021-08-19  
Date published: 2022-07-22  
CVSSv3 Score: 4.7 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N)  
CVE: CVE-2021-24910  
  
  
2. CREDITS  
==========  
This vulnerability was discovered and researched by Julien Ahrens from  
RCE Security.  
  
  
3. VERSIONS AFFECTED  
====================  
Transposh WordPress Translation 1.0.7 and below  
  
  
4. INTRODUCTION  
===============  
Transposh translation filter for WordPress offers a unique approach to blog  
translation. It allows your blog to combine automatic translation with human  
translation aided by your users with an easy to use in-context interface.  
  
(from the vendor's homepage)  
  
  
5. VULNERABILITY DETAILS  
========================  
The plugin's ajax action "tp_tp" is vulnerable to an unauthenticated/authenticated  
reflected Cross-Site Scripting vulnerability when user-supplied input to the HTTP  
GET parameter "q" is processed by the web application. Since the application does  
not properly validate and sanitize this parameter, it is possible to place  
arbitrary script code onto the same page.  
  
This offers a wide range of possible attacks such as redirecting the user to a  
malicious page, spoofing content on the page or attacking the browser and its  
plugins. Since all session-relevant cookies are protected by HTTPOnly, it is not  
possible to hijack sessions.  
  
  
6. PROOF OF CONCEPT  
===================  
The following PoC triggers a JavaScript alert:  
  
http://[host]/wp-admin/admin-ajax.php?action=tp_tp&e=g&m=s&tl=en&q=<img%20src%3dx%20onerror%3dalert(document.cookie)>  
  
  
7. SOLUTION  
===========  
Update to Transposh 1.0.8.1  
  
  
8. REPORT TIMELINE  
==================  
2021-08-19: Discovery of the vulnerability  
2021-08-20: Contacted the vendor via their contact form  
2021-08-20: Vendor response  
2021-08-20: Sent all the PoC exploits  
2021-08-20: Vendor acknowledges the issues  
2021-09-14: Requested status update from vendor  
2021-10-07: No response from vendor, requested status update again  
2021-10-25: CVE requested from WPScan (CNA)  
2021-10-27: WPScan assigns CVE-2021-24910  
2022-02-22: Vendor releases 1.0.8 which fixes this vulnerability  
2022-07-22: Public disclosure  
  
  
9. REFERENCES  
=============  
https://github.com/MrTuxracer/advisories  
https://transposh.org/version-1-0-8-thanks-julien/  
`