WordPress and WordPress plugins have cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Loco Translate plugin version prior to 2.6.1 has a cross-site scripting vulnerability, which can be exploited by attackers t...

CVE-2022-0770

The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access t...

CVE-2021-24721

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...

CVE-2021-40864

The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...

CVE-2021-40864

The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...

CVE-2021-40864

The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...

Code injection

The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...

CVE-2021-40864

CVE-2021-40864 affects the Translate plugin for ONLYOFFICE Document Server (versions 6.1.x–6.3.x prior to 6.3.0.72). The vulnerability stems from missing escape calls for the msg.data and text fields, leading to improper handling of input. The NVD metrics indicate a high to critical impact, with ...

CVE-2021-40864

The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields...

PT-2021-22992

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server Translate plugin versions 6.1.x through 6.3.x before 6.3.0.72 Description The issue is related to the lack of escape calls for the msg.data and text fields in the Translate plugin. This could potentially lead to...

CVE-2017-18568

The my-wp-translate plugin before 1.0.4 for WordPress has XSS...

CVE-2017-18569

The my-wp-translate plugin before 1.0.4 for WordPress has CSRF...

Cross site scripting

The my-wp-translate plugin before 1.0.4 for WordPress has XSS...

CVE-2017-18568

CVE-2017-18568 affects the WordPress plugin my-wp-translate (before version 1.0.4). The vulnerability is cross-site scripting (XSS) caused by lack of proper validation of client-side data in the plugin. Impact ranges from partial integrity impact to potential user-observed content manipulation; C...