Design/Logic Flaw

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tpreset� under the Utilities tab /wp-admin/admin.php?page=tputils, which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerabl...

CVE-2022-25812

The CVE-2022-25812 entry concerns the Transposh WordPress Translation plugin for WordPress, affected in versions up to 1.0.8.1 (and earlier per sources). The vulnerability stems from the plugin’s handling of log/debug input in the save_transposh flow, specifically a missing log file extension che...

CVE-2022-25812 Transposh WordPress Translation < 1.0.8 - Admin+ RCE

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE...

CVE-2022-25811

The CVE-2022-25811 entry concerns the Transposh WordPress Translation plugin for WordPress, affected in versions 1.0.8 and earlier (

CVE-2022-25811 Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection

The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection...

CVE-2022-25810

The CVE-2022-25810 entry applies to the Transposh WordPress Translation plugin (versions up to 1.0.8.1). The vulnerability is due to missing authorization checks on functions exposed under the Utilities page (/wp-admin/admin.php?page=tp_utils), allowing a lowest-privileged user to execute sensiti...

CVE-2022-25810 Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tpreset” under the Utilities tab /wp-admin/admin.php?page=tputils, which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable th...

CVE-2021-24912

The CVE-2021-24912 entry concerns the Transposh WordPress Translation plugin for WordPress, specifically versions up to 1.0.8. The underlying issue is the lack of CSRF protection in the tp_translation AJAX action and insufficient sanitisation of the tk0 parameter, enabling Stored XSS executed in ...

CVE-2021-24912 Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tptranslation AJAX action, which could allow attackers to make authorised users add a translation. Given the lack of sanitisation in the tk0 parameter, this could lead to a Stored Cross-Site Scriptin...

CVE-2021-24911 Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tptranslation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack...

CVE-2021-24911

The CVE relates to the Transposh WordPress Translation plugin for WordPress, affected versions prior to 1.0.8. The root cause is failure to sanitize and escape the tk0 parameter in the tp_translation AJAX action, allowing Stored Cross-Site Scripting. Impact is an XSS that can trigger in the plugi...

CVE-2021-24910 Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in the response, leading to a Reflected Cross-Si...

CVE-2021-24910

The CVE-2021-24910 entry concerns the WordPress plugin Transposh Translation (before 1.0.8). Affected component: the plugin’s AJAX action, which unsafely outputs the unescaped value of the a parameter back in the response. Root cause: insufficient sanitisation/escaping of user input in the tp_tp ...

Transposh WordPress Translation 1.0.8.1 Incorrect Authorization Vulnerability

ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Incorrect Authorization CWE-863 Date found: 2022-07-23 Date published: 2022-08-16 CVSSv3 Score: 7.5...

Transposh WordPress Translation 1.0.8.1 Incorrect Authorization

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Incorrect Authorization CWE-863 Date found: 2022-07-23 Date...

PT-2022-17238 · WordPress · Transposh Wordpress Translation Plugin

Name of the Vulnerable Software and Affected Versions: Transposh WordPress Translation plugin versions up to, and including, 1.0.8.1 Description: The issue allows unauthorized setting changes by unauthenticated users due to insufficient validation of settings on the 'tp translation' AJAX action...

WordPress plugin transposh-translation-filter-for-wordpress 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin...

OPENSUSE-SU-2022:10088-1 Security update for opera

This update for opera fixes the following issues: Opera was updated to 89.0.4447.71 - CHR-8957 Update chromium on desktop-stable-103-4447 to 103.0.5060.134 - DNA-100492 authPrivate.storeCredentials should work with running auth session - DNA-100649 “Sign out” from settings doesn’t also sign out...

OPENSUSE-SU-2022:10087-1 Security update for opera

This update for opera fixes the following issues: opera was updated to 89.0.4447.71 - CHR-8957 Update chromium on desktop-stable-103-4447 to 103.0.5060.134 - DNA-100492 authPrivate.storeCredentials should work with running auth session - DNA-100649 “Sign out” from settings doesn’t also sign out...

Virtuozzo Hybrid Infrastructure 5.2 (5.2.0-135)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that enhance compute services, the cluster management and upgrade process, monitoring and alerts, the user interface, and the documentation. Additionally, this release delivers stability improvements and addresses...