42 matches found
CVE-2023-49161 WordPress Bravo Translate Plugin <= 1.2 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2...
WordPress Bravo Translate Plugin <= 1.2 is vulnerable to SQL Injection
Software Bravo Translate Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-49161 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 9e3d902f085a Credits Arvandy Required privilege Administrator Published 28...
CVE-2023-26515
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ko Takagi Simple Slug Translate plugin = 2.7.2 versions...
CVE-2023-0832
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the installweglot function called via the adminactioninstallweglot action. This makes it possible for...
Cross site request forgery (csrf)
The Under Construction plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.96. This is due to missing or incorrect nonce validation on the installweglot function called via the adminactioninstallweglot action. This makes it possible for...
PT-2023-16556 · Unknown +1 · Weglot Translate +1
Name of the Vulnerable Software and Affected Versions: Under Construction plugin for WordPress versions up to and including 3.96 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the install weglot function called via the admin action...
CVE-2022-0765
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin Translator and Administrator by default to add...
CVE-2022-0765
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin Translator and Administrator by default to add...
PT-2022-13421
Name of the Vulnerable Software and Affected Versions Loco Translate WordPress plugin versions prior to 2.6.1 Description The issue allows any user with access to the plugin, such as Translator and Administrator, to add arbitrary javascript payloads to the source strings, leading to a stored...
WordPress和WordPress plugin 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Loco Translate plugin version prior to 2.6.1 has a cross-site scripting vulnerability, which can be exploited by attackers t...
CVE-2022-0770
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access t...
CVE-2021-24721
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...
CVE-2021-40864
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...
CVE-2021-40864
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...
CVE-2021-40864
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...
Code injection
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...
CVE-2021-40864
CVE-2021-40864 affects the Translate plugin for ONLYOFFICE Document Server (versions 6.1.x–6.3.x prior to 6.3.0.72). The vulnerability stems from missing escape calls for the msg.data and text fields, leading to improper handling of input. The NVD metrics indicate a high to critical impact, with ...
CVE-2021-40864
The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...