{"uuid": "7eea46aa-1ffe-48ce-9f98-93582f70e580", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2461", "type": "seen", "source": "https://t.me/hacking_Attack/63493", "content": "Exploit Collector\nTransposh WordPress Translation 1.0.7 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png Transposh WordPress Translation versions 1.0.7 and below have an ajax action \"tp_translation\" which is available to authenticated or unauthenticated users (see CVE-2022-2461) that allows them to submit new translations. Translations submitted this way are shown on the Transposh administrative interface on the pages \"tp_main\" and \"tp_editor\". However, since the plugin does not properly validate and sanitize the submitted translation, arbitrary Javascript code can be permanently injected and executed directly within the backend across all users visiting the page with the roles of at least \"Subscriber\" and up to \"Administrator\".\n\nSHA-256 | 484332c9e36ec88f8a190cc80119a1f22da60e0f49e9a327a7f7268bba597fb7Download RCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Transposh WordPress Translation\nVendor URL:     https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/\nType:           Cross-Site Scripting [CWE-79]\nDate found:     2021-08-19\nDate published: 2022-07-22\nCVSSv3 Score:   6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)\nCVE:            CVE-2021-24911\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nTransposh WordPress Translation 1.0.7 and below\n4. INTRODUCTION\n===============\nTransposh translation filter for WordPress offers a unique approach to blog\ntranslation. It allows your blog to combine automatic translation with human\ntranslation aided by your users with an easy to use in-context interface.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin's ajax action \"tp_translation\" which is available to authenticated or\nunauthenticated users (see CVE-2022-2461) allows to submit new translations.\n\nTranslations submitted this way are shown on the Transposh administrative\ninterface on the pages \"tp_main\" and \"tp_editor\". However, since the plugin does\nnot properly validate and sanitize the submitted translation, arbitrary Javascript\ncode can be permanently injected and executed directly within the backend across\nall users visiting the page with the roles of at least \"Subscriber\" and up to\n\"Administrator\".\n\nThis offers a wide range of possible attacks, such as redirecting the user to a\nmalicious page, spoofing content on the page, or attacking the browser and its\nplugins.\n6. PROOF OF CONCEPT\n===================\nThe following PoC adds a new translation:\n7. SOLUTION\n===========\nUpdate the plugin to version 1.0.8.1\n8. REPORT TIMELINE\n==================\n2021-08-19: Discovery of the vulnerability\n2021-08-20: Contacted the vendor via their contact form\n2021-08-20: Vendor response\n2021-08-20: Sent all the PoC exploits\n2021-08-20: Vendor acknowledges the issues\n2021-09-14: Requested status update from vendor\n2021-10-07: No response from vendor, requested status update again\n2021-10-25: CVE requested from WPScan (CNA)\n2021-10-27: WPScan assigns CVE-2021-24911\n2022-02-22: Vendor releases 1.0.8, which fixes this vulnerability\n2022-07-22: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\nhttps://transposh.org/version-1-0-8-thanks-julien/\nhttps://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ Source:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:33.066709Z"}