Read the docs

oferwald

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

oferwald records in CISA KEV

No oferwald vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Transposh Wordpress Translation 9 records MEDIUM

Records

9 records

TI-2022-02272 CVE-2022-2461 · GHSA-3xc8-4p8r-q7hj

Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change

Priority MEDIUM 63

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05109 Published 2022-09-06 No fix listed CWE-862
TI-2022-02343 CVE-2022-2536 · GHSA-ggf6-w57c-2rj4

Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass

Priority MEDIUM 42

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01451 Published 2022-12-15 No fix listed CWE-285
TI-2022-09382 CVE-2022-25812 · GHSA-r3hj-92hh-4g2x

Transposh WordPress Translation < 1.0.8 - Admin+ RCE

Priority LOW 35

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01745 Published 2022-08-22 Fixed in 1.0.8 CWE-94
TI-2022-09381 CVE-2022-25811 · GHSA-qpxf-h287-r5r8

Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection

Priority LOW 35

The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01456 Published 2022-08-22 No fix listed CWE-89
TI-2022-09380 CVE-2022-25810 · GHSA-7j8w-jqvj-386m

Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls

Priority LOW 31

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01024 Published 2022-08-22 No fix listed CWE-862
TI-2021-07190 CVE-2021-24910 · GHSA-vvqg-9xpw-c884

Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting

Priority LOW 31

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is instal…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01672 Published 2022-08-22 Fixed in 1.0.8 CWE-79
TI-2021-07191 CVE-2021-24911 · GHSA-p553-xq2c-fgrg

Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

Priority LOW 26

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00689 Published 2022-08-22 Fixed in 1.0.8 CWE-79
TI-2021-07192 CVE-2021-24912 · GHSA-76qx-g957-hwpc

Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS

Priority LOW 24

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00348 Published 2022-08-22 Fixed in 1.0.8 CWE-352
Open these records in search →