CVE-2022-0765CWE-79

CVE-2022-0765: fallo en Loco Translate

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Loco Translate

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

18Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 3.8%
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
Productos afectados
Unknown · Loco Translate
CVEs relacionadas — Loco Translate

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24721—Loco Translate < 2.5.4 - Authenticated PHP Code InjectionEPSS 0.9%CVE-2026-94238MEDIUMLoco Translate < 2.8.9 - Translator+ Limited File Read via 'path' ParameterEPSS 0.3%CVE-2026-94239MEDIUMLoco Translate < 2.8.9 - Translator+ Stored XSS via Bundle ConfigurationEPSS 0.2%