TranslatePress plugin stored XSS via comment input
Site visitors' information can be stolen.
Summary
A flaw in how the TranslatePress WordPress plugin handles comment input lets an attacker plant malicious scripts in pages that run for visitors. All versions up to and including 3.3.8 are affected.
Affected when
- A secondary language configured in the site
- At least one previously approved comment from the attacker's name and email pair (WordPress default comment moderation)
What to do
No fixed version is named in the sources. Check that the installed plugin is newer than 3.3.8 and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen