Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: oferwald Clear all filters
TI-2022-02343 CVE-2022-2536 · GHSA-ggf6-w57c-2rj4

Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass

Priority MEDIUM 42

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01451 Published 2022-12-15 No fix listed CWE-285
TI-2022-02272 CVE-2022-2461 · GHSA-3xc8-4p8r-q7hj

Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change

Priority MEDIUM 63

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05109 Published 2022-09-06 No fix listed CWE-862
TI-2022-09382 CVE-2022-25812 · GHSA-r3hj-92hh-4g2x

Transposh WordPress Translation < 1.0.8 - Admin+ RCE

Priority LOW 35

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01724 Published 2022-08-22 Fixed in 1.0.8 CWE-94
TI-2022-09381 CVE-2022-25811 · GHSA-qpxf-h287-r5r8

Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection

Priority LOW 35

The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01438 Published 2022-08-22 No fix listed CWE-89
TI-2022-09380 CVE-2022-25810 · GHSA-7j8w-jqvj-386m

Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls

Priority LOW 31

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01043 Published 2022-08-22 No fix listed CWE-862
TI-2021-07192 CVE-2021-24912 · GHSA-76qx-g957-hwpc

Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS

Priority LOW 24

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not have CSRF check in its tp_translation AJAX action, which could allow attackers to make authorised users add a translation.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00355 Published 2022-08-22 Fixed in 1.0.8 CWE-352
TI-2021-07191 CVE-2021-24911 · GHSA-p553-xq2c-fgrg

Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

Priority LOW 26

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admi…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00702 Published 2022-08-22 Fixed in 1.0.8 CWE-79
TI-2021-07190 CVE-2021-24910 · GHSA-vvqg-9xpw-c884

Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting

Priority LOW 31

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the a parameter via an AJAX action (available to both unauthenticated and authenticated users when the curl library is instal…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01703 Published 2022-08-22 Fixed in 1.0.8 CWE-79