Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: Loco Translate Project Component: Loco Translate Clear all filters
TI-2022-00675 CVE-2022-0765 · GHSA-pr4c-mq97-968p

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

Priority LOW 31

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user wi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.03832 Published 2022-04-18 Fixed in 2.6.1 CWE-79
TI-2021-07003 CVE-2021-24721 · GHSA-8mj6-23hc-v88f

Loco Translate < 2.5.4 - Authenticated PHP Code Injection

Priority LOW 31

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject P…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0094 Published 2021-11-08 Fixed in 2.5.4 CWE-94