CVE-2021-25103: GTranslate < 2.9.7 - Reflected Cross-Site Scripting
The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the urladdon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCESALT and NONCEKEY
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25103?
CVE-2021-25103 is classified as a medium severity vulnerability due to its potential for exploitation via reflected Cross-Site Scripting.
How do I fix CVE-2021-25103?
To fix CVE-2021-25103, update the Translate WordPress with GTranslate plugin to version 2.9.7 or newer.
What systems are affected by CVE-2021-25103?
CVE-2021-25103 affects the Translate WordPress with GTranslate plugin versions prior to 2.9.7 on WordPress installations.
What type of issue is CVE-2021-25103 associated with?
CVE-2021-25103 is associated with a reflected Cross-Site Scripting (XSS) vulnerability.
Is user data at risk due to CVE-2021-25103?
Yes, CVE-2021-25103 can potentially expose user data to attacks if exploited.