CVE-2021-24911: Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-22 · updated 2026-06-17
Weakness: CWE-79

Description

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tp_translation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack depends on the plugin "Who can translate ?" setting.

Affected products

Transposh WordPress Translation: before 1.0.8 — fixed in 1.0.8

How to fix

Upgrade to a fixed version: Transposh WordPress Translation 1.0.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24911 or the next vulnerability affects your stack