Vulnerability · Published Apr 18, 2022 · Assigned by WPScan
CVE-2022-0765Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting
Medium 5.4
In plain English
A medium-severity cross-site scripting in Loco Translate from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.8% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Loco Translate | 2.6.1 – before 2.6.1 |
Weakness: CWE-79