{"uuid": "31c6d73d-a340-471c-8736-ce2f2a331b60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24610", "type": "seen", "source": "https://t.me/hacking_Attack/25363", "content": "Exploit Collector\nWordPress TranslatePress 2.0.8 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png \nWordPress TranslatePress plugin version 2.0.8 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | cb0dfac0cf52af1f4c77f09caf67ea09\n\nDownload\n# Exploit Title: WordPress Plugin TranslatePress 2.0.8 - Stored Cross-Site Scripting (XSS) (Authenticated)\n# Date: 06-08-2021\n# Exploit Author: Nosa Shandy (Apapedulimu)\n# Vendor Homepage: https://translatepress.com/\n# Software Link: https://wordpress.org/plugins/translatepress-multilingual/ \n# Reference: https://wpscan.com/vulnerability/b87fcc2f-c2eb-4e23-9757-d1c590f26d3f\n# Version: 2.0.6 \n# Tested on: macOS 11.4\n# CVE : CVE-2021-24610\n\nDescription:\nThe plugin does not implement a proper filter on the 'translated' parameter when input to the database. The 'trp_sanitize_string' function only check the \"\" with the preg_replace, the attacker can use the HTML Tag to execute javascript.\n\nStep To Reproduce:\n1. Go to http://localhost:8888/wordpress/?trp-edit-translation=true\n2. Input Gettext String\n3. Input the payload such as x \n4. Save, The payload will be executed.\n5. Look on the homepage will be affected.\n\nVideo : https://drive.google.com/file/d/1PnvjHuKCvjmom6xz_sxNLBu3jixCiHy_/view?usp=sharing\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:49.514936Z"}