CVE-2021-24911 — Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Sit…
Published: 2022-08-22 · CVSS: Unscored
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7