CVE-2022-45072

CVE-2022-45072 affects WPML Multilingual CMS premium plugin

CVE-2022-45072 WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPML Multilingual CMS premium plugin = 4.5.13 on WordPress...

WPML < 4.5.11 - Subscriber+ Settings Update

The plugin does not have authorisation check when updating the selected language for legacy widgets and default behaviour for media content settings, which could allow any authenticated users, such as subscriber to update them...

WPML < 4.5.11 - Subscriber+ Translation Job Status Update

The plugin does not have authorisation when updating the status of translation jobs, which could allow any authenticated users, such as subscriber to perform such action...

WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to status change of translation job discovered by Dave Jong Patchstack in WordPress WPML Multilingual CMS premium plugin versions = 4.5.13. Solution Update the WordPress Multilingual CMS plugin to the latest available version at least 4.5.14...

WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Dave Jong Patchstack in WordPress WPML Multilingual CMS premium plugin versions = 4.5.13 Solution Update the WordPress Multilingual CMS plugin to the latest available version at least 4.5.14...

WPML < 4.5.14 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as change the status of a translation job...

WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

Broken Access Control vulnerability leading to status change of translation job discovered by Dave Jong Patchstack in the WordPress WPML Multilingual CMS premium plugin versions = 4.5.10. Solution Update the WordPress Multilingual CMS plugin to the latest available version at least 4.5.11...

Design/Logic Flaw

The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugin...

CVE-2022-3494 Complianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLi

The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugin...

Complianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLi

The plugins allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML. PoC 1. Install Complianz and set the following...

Remote code execution

The sitepress-multilingual-cms WPML plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings...

CVE-2020-10568

The CVE concerns the WordPress WPML plugin (sitepress-multilingual-cms) prior to 4.3.7-b.2. A CSRF flaw caused by a loose integer-to-string comparison in includes/class-wp-installer.php enables remote code execution. Public descriptions consistently frame this as an authenticated CSRF vulnerabili...

WordPress WPML plugin <= 4.3.6 - Authenticated Cross-Site Request Forgery (CSRF) vulnerability leading to Remote Code Execution (RCE)

Authenticated Cross-Site Request Forgery CSRF vulnerability leading to Remote Code Execution RCE discovered by Gerard Arall in WordPress WPML plugin versions = 4.3.6. Solution Update the WordPress WPML plugin to the latest available version at least 4.3.7...

CVE-2015-9416

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

Design/Logic Flaw

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

CVE-2015-9416

CVE-2015-9416 affects the WordPress WPML plugin (sitepress-multilingual-cms) versions 2.9.3–3.2.6. Affected component: WPML; root cause: cross-site scripting via the Accept-Language HTTP header. Impact: allows execution of client-side code in victims’ browsers (XSS). Notable sources corroborate X...

CVE-2015-9416

The sitepress-multilingual-cms WPML plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header...

CVE-2018-18069

processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...

Design/Logic Flaw

processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...