CVE-2024-2124: Translate WordPress and go Multilingual – Weglot <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 4.2.5 due to insufficient input sanitization and output escaping on user supplied attributes such as 'className'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2124?
CVE-2024-2124 is classified as a medium severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-2124?
To fix CVE-2024-2124, update the Translate WordPress and go Multilingual – Weglot plugin to version 4.2.6 or later.
What versions are affected by CVE-2024-2124?
CVE-2024-2124 affects all versions of the Translate WordPress and go Multilingual – Weglot plugin up to and including version 4.2.5.
What type of attack can CVE-2024-2124 lead to?
CVE-2024-2124 can lead to Stored Cross-Site Scripting attacks, allowing attackers to inject malicious scripts.
What input validation issue is present in CVE-2024-2124?
CVE-2024-2124 is due to insufficient input sanitization and output escaping on user-supplied attributes such as 'className'.