2 lines
3.0 KiB
JSON
2 lines
3.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"Loco Translate","vendor":"Unknown","versions":[{"lessThan":"2.6.1","status":"affected","version":"2.6.1","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:loco_translate_project:loco_translate:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"A3EB8F5D-A505-4D1B-8738-B350EB4C2B3D","versionEndExcluding":"2.6.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability."},{"lang":"es","value":"El plugin Loco Translate de WordPress versiones anteriores a 2.6.1, no elimina correctamente los eventos inline de los elementos en las cadenas de traducción de origen antes de mostrarlos en el editor del panel de administración del plugin, lo que permite a cualquier usuario con acceso al plugin (traductor y administrador por defecto) añadir cargas útiles de javascript arbitrarias a las cadenas de origen, conllevando a una vulnerabilidad de tipo Cross-Site Scripting (XSS) almacenada"}],"id":"CVE-2022-0765","lastModified":"2026-06-17T04:21:12.240","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":3.5,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":6.8,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-04-18T18:15:08.420","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/58838f51-323d-41e0-8c85-8e113dc2c587"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/58838f51-323d-41e0-8c85-8e113dc2c587"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"contact@wpscan.com","type":"Secondary"}]}
|