CVE-2021-24610: TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trpsanitizestring' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24610?
CVE-2021-24610 is a vulnerability in the TranslatePress WordPress plugin before version 2.0.9 that allows for the execution of JavaScript through unsanitized translated strings.
How does CVE-2021-24610 impact WordPress websites?
CVE-2021-24610 allows attackers to execute malicious JavaScript code on vulnerable TranslatePress WordPress installations, potentially leading to cross-site scripting (XSS) attacks.
What is the severity of CVE-2021-24610?
CVE-2021-24610 has a severity rating of medium with a CVSS score of 4.8.
How can CVE-2021-24610 be exploited?
Attackers can exploit CVE-2021-24610 by injecting malicious JavaScript code into translated strings, which will be executed when viewed by authenticated users.
Is there a patch available for CVE-2021-24610?
Yes, the vulnerability has been addressed in version 2.0.9 of the TranslatePress WordPress plugin, so updating to this version or later will fix the issue.