CVE-2021-24911

El plugin Transposh WordPress Translation de WordPress versiones anteriores a 1.0.8, no sanea ni escapa del parámetro tk0 de la acción AJAX tp_translation, lo que conlleva a un problema de tipo Cross-Site Scripting Almacenado, que se ejecutará en el panel de administración del plugin. El rol mínimo necesario para llevar a cabo este ataque depende de la configuración del plugin "¿Quién puede traducir?

The Transposh WordPress Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tk0' parameter in versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Transposh WordPress Translation versions 1.0.7 and below have an ajax action "tp_translation" which is available to authenticated or unauthenticated users (see CVE-2022-2461) that allows them to submit new translations. Translations submitted this way are shown on the Transposh administrative interface on the pages "tp_main" and "tp_editor". However, since the plugin does not properly validate and sanitize the submitted translation, arbitrary Javascript code can be permanently injected and executed directly within the backend across all users visiting the page with the roles of at least "Subscriber" and up to "Administrator".