CVE-2024-8095: BabelZ – Google Translate Widget <= 1.1.5 - CSRF to Stored XSS
The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8095?
CVE-2024-8095 is a critical vulnerability that allows for Stored XSS attacks due to insufficient CSRF checks and missing sanitization in the BabelZ WordPress plugin.
How do I fix CVE-2024-8095?
To fix CVE-2024-8095, update the BabelZ WordPress plugin to a version later than 1.1.5 where the vulnerabilities are addressed.
What type of attack does CVE-2024-8095 facilitate?
CVE-2024-8095 facilitates Stored XSS attacks through CSRF, allowing attackers to inject malicious scripts.
Which versions of BabelZ are affected by CVE-2024-8095?
CVE-2024-8095 affects BabelZ Google Translate Widget versions up to and including 1.1.5.
Is user login required to exploit CVE-2024-8095?
Yes, CVE-2024-8095 requires that the attacker targets a logged-in admin to successfully execute the Stored XSS payload.