Cross site scripting

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin Translator and Administrator by default to add...

CVE-2022-0765 Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin Translator and Administrator by default to add...

CVE-2022-0765

CVE-2022-0765 affects the WordPress Loco Translate plugin prior to version 2.6.1. A stored XSS exists because the plugin does not properly remove inline events from source translation strings before output in the editor, allowing authenticated users (Translator/Administrator by default) to inject...

PT-2022-13421

Name of the Vulnerable Software and Affected Versions Loco Translate WordPress plugin versions prior to 2.6.1 Description The issue allows any user with access to the plugin, such as Translator and Administrator, to add arbitrary javascript payloads to the source strings, leading to a stored...

WordPress Loco Translate plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Loco Translate plugin version prior to 2.6.1 has a cross-site scripting vulnerability, which can be exploited by attackers t...

WordPress Loco Translate Cross Site Scripting

Tittle: WordPress Plugin Loco Translate ' 7. Save 8. Replicated POC2 via example.po 1. Got to Plugin Loco Translate 2. Enter Plugins Options Any Plugin 3. Upload PO options 3. Load example.po Example.po msgid "" msgstr "" "Project-Id-Version: xss-tester\n" "Report-Msgid-Bugs-To: \n"...

WordPress和WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Loco Translate plugin version prior to 2.6.1 has a cross-site scripting vulnerability, which can be exploited by attackers t...

WordPress Loco Translate Plugin < 2.6.1 - Authenticated Stored Cross-Site Scripting Vulnerability

Tittle: WordPress Plugin Loco Translate ' 7. Save 8. Replicated POC2 via example.po 1. Got to Plugin Loco Translate 2. Enter Plugins Options Any Plugin 3. Upload PO options 3. Load example.po Example.po msgid "" msgstr "" "Project-Id-Version: xss-tester\n" "Report-Msgid-Bugs-To: \n"...

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

The plugin does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin Translator and Administrator by default to add arbitrary javascript payloads to the source...

WordPress Loco Translate plugin <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Taurus Omar in WordPress Loco Translate plugin versions = 2.6.0. Solution Update the WordPress Loco Translate plugin to the latest available version at least 2.6.1...

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

The plugin does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin Translator and Administrator by default to add arbitrary javascript payloads to the source...

WordPress Loco Translate Plugin < 2.5.4 PHP Injection Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-24721

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...

CVE-2021-24721

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...

CVE-2021-24721

CVE-2021-24721 affects the WordPress plugin Loco Translate prior to version 2.5.4 . The vulnerability arises because data inputs saved by the plugin can be renamed to a file ending in “.php,” allowing an authenticated translator user to inject PHP code into web‑accessible PHP files. Impact is tha...

CVE-2021-24721 Loco Translate < 2.5.4 - Authenticated PHP Code Injection

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations...

Loco Translate < 2.5.4 - Authenticated PHP Code Injection

The plugin mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations. PoC 1. Using a User with the translator role,...

Loco Translate < 2.5.4 - Authenticated PHP Code Injection

The plugin mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations. 1. Using a User with the translator role, navigate...

WordPress Loco Translate plugin <= 2.5.3 - Authenticated PHP Code Injection vulnerability

Authenticated PHP Code Injection vulnerability discovered by Tomi Ashari in WordPress Loco Translate plugin versions = 2.5.3. Solution Update the WordPress Loco Translate plugin to the latest available version at least 2.5.4...

WordPress Loco Translate 2.2.1 Local File Inclusion

Exploit Title: Wordpress Loco Translate Version 2.2.1 Plugin LFI Google Dork: N/A Date: 03 / 26 / 2019 Exploit Author: Ali S. Ahmad S4R1N Vendor Homepage: https://localise.biz/ Software Link: https://wordpress.org/plugins/loco-translate/ Version: Version 2.2.1 Tested on: Debian GNU/Linux 9 Docker...