Read the docs

Loco Translate Project

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Loco Translate Project records in CISA KEV

No Loco Translate Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Loco Translate 2 records LOW

Records

2 records

TI-2022-00675 CVE-2022-0765 · GHSA-pr4c-mq97-968p

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

Priority LOW 31

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user wi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.03832 Published 2022-04-18 Fixed in 2.6.1 CWE-79
TI-2021-07003 CVE-2021-24721 · GHSA-8mj6-23hc-v88f

Loco Translate < 2.5.4 - Authenticated PHP Code Injection

Priority LOW 31

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject P…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0094 Published 2021-11-08 Fixed in 2.5.4 CWE-94
Open these records in search →