CVE-2022-2461

The Transposh WordPress Translation plugin is affected by CVE-2022-2461. Affected software: Transposh WordPress Translation plugin for WordPress. Vulnerable component: the tp_translation AJAX action, due to insufficient permissions checking. Root cause: unauthenticated users can trigger unauthori...

CVE-2022-2462

The CVE-2022-2462 entry concerns the Transposh WordPress Translation plugin (versions up to and including 1.0.8.1). The vulnerability arises from insufficient permissions checking on the AJAX action tp_history and overly permissive data in the response, enabling unauthenticated disclosure of tran...

CVE-2022-25810

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tpreset” under the Utilities tab /wp-admin/admin.php?page=tputils, which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable th...

CVE-2021-24910

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in the response, leading to a Reflected Cross-Si...

Code injection

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE...

CVE-2021-24912

The CVE-2021-24912 entry concerns the Transposh WordPress Translation plugin for WordPress, specifically versions up to 1.0.8. The underlying issue is the lack of CSRF protection in the tp_translation AJAX action and insufficient sanitisation of the tk0 parameter, enabling Stored XSS executed in ...

CVE-2021-24912 Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tptranslation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scriptin...

WordPress plugin Transposh WordPress Translation 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress plugin Transposh WordPress Translation 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Transposh WordPres...

Cross-site Request Forgery (CSRF)

The Jenkins Translation plugin is vulnerable to cross-site request forgery CSRF attacks. POST requests don't require a form submission to be submitted. Leveraging this, attackers can override localized strings displayed to all users when the victim is a Jenkins administrator...