CVE-2021-24610

The CVE-2021-24610 entry concerns the WordPress TranslatePress plugin (pre-2.0.9). The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) caused by insufficient sanitisation in the translation pipeline: the trp_sanitize_string function only removes script tags via regex, permitti...

CVE-2021-24610 TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting

The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trpsanitizestring' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored...