Translate WordPress – Google Language Translator < 6.0.12 – Admin+ Stored Cross-Site Scripting | CVE 2021-24594 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

Put the following payload in the Floating Widget Settings > Custom text for the floating widget: <svg onload=alert(/XSS/)>

The XSS will be triggered in the plugin's settings page, as well as all frontend pages.

Affects Plugins

google-language-translator

Fixed in 6.0.12

References

CVE

URL

https://www.hackpertise.com/cve/20-cve-2021-24594/

URL

https://plugins.trac.wordpress.org/changeset/2607480/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Asif Nawaz Minhas

Submitter

Asif Nawaz Minhas

Verified

Yes

WPVDB ID

cf7b0f07-8b9b-40a1-ba7b-e8d34f515a6b

Timeline

Publicly Published

2021-10-05 (about 4 years ago)

Added

2021-10-05 (about 4 years ago)

Last Updated

2023-04-12 (about 2 years ago)

Other

Published

Title

Published

2024-05-30

Title

Happy Addons for Elementor < 3.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget

Published

2024-11-08

Title

AA Audio Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2014-11-20

Title

WP Statistics <= 8.3 - Stored & Reflected Cross-Site Scripting (XSS)

Published

2025-06-05

Title

Melipayamak <= 2.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2022-10-17

Title

WP < 6.0.3 - Stored XSS via RSS Widget