CVE-2022-3141CWE-89

CVE-2022-3141: vulnerability in Translate Multilingual sites – TranslatePress

Translatepress Multilinugal < 2.3.3 - Admin+ SQLi

Published · Updated

Follow this CVE+ Monitor Translate Multilingual sites – TranslatePress

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 5.2%
from disclosure to weapon187 days
Published on NVDSep 19
1st PoC+187d
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.
Affected products
Unknown · Translate Multilingual sites – TranslatePress
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Translate Multilingual sites – TranslatePress

In the same product, most dangerous first.

CVE-2021-24610—TranslatePress < 2.0.9 - Authenticated Stored Cross-Site ScriptingEPSS 5.4%