CVE-2023-4502: Translate WordPress with GTranslate < 3.0.4 - Admin+ Stored XSS
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the Translate WordPress with GTranslate WordPress plugin vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-4502.
What is the severity level of CVE-2023-4502?
The severity level of CVE-2023-4502 is medium, with a severity value of 4.8.
How does the Translate WordPress with GTranslate WordPress plugin vulnerability allow high privilege users to perform attacks?
The vulnerability allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks.
Can the Translate WordPress with GTranslate WordPress plugin vulnerability be exploited even when the unfiltered_html capability is disallowed?
Yes, the vulnerability can be exploited even when the unfiltered_html capability is disallowed.
What is the affected version range for the Translate WordPress with GTranslate WordPress plugin vulnerability?
The affected version range for this vulnerability is up to and excluding version 3.0.4.