CVE-2022-3691: Files or Directories Accessible to External Parties

The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information including the DeepL API key in files that are publicly accessible to an external, unauthenticated visitor...

CVE-2022-3691

CVE-2022-3691 affects the WordPress DeepL Pro API Translation plugin, versions prior to 1.7.5. The root cause is insufficient protection of sensitive data, resulting in API keys and other information being disclosed in publicly accessible files or logs. The impact is exposure of the DeepL API key...

CVE-2022-2461

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...

CVE-2022-2461

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes in versions up to and including 1.0.9.6 (and specifically mentioned as 1.0.8.1 in several sources). The root cause is insufficient permissions checking on the tp_translation AJAX action and defa...

CVE-2022-2462

The CVE-2022-2462 entry concerns the Transposh WordPress Translation plugin (versions up to and including 1.0.8.1). The vulnerability arises from insufficient permissions checking on the AJAX action tp_history and overly permissive data in the response, enabling unauthenticated disclosure of tran...

CVE-2022-25810

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tpreset” under the Utilities tab /wp-admin/admin.php?page=tputils, which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable th...

CVE-2021-24910

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in the response, leading to a Reflected Cross-Si...

Code injection

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE...

CVE-2021-24912

The CVE-2021-24912 entry concerns the Transposh WordPress Translation plugin for WordPress, specifically versions up to 1.0.8. The underlying issue is the lack of CSRF protection in the tp_translation AJAX action and insufficient sanitisation of the tk0 parameter, enabling Stored XSS executed in ...

CVE-2021-24912 Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tptranslation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scriptin...

WordPress plugin Transposh WordPress Translation 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress plugin Transposh WordPress Translation 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Transposh WordPres...

Cross-site Request Forgery (CSRF)

The Jenkins Translation plugin is vulnerable to cross-site request forgery CSRF attacks. POST requests don't require a form submission to be submitted. Leveraging this, attackers can override localized strings displayed to all users when the victim is a Jenkins administrator...