Description
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Translate WordPress with Weglot 2.0 | < 6.4.3 | 6.4.3 |
References
- https://wpscan.com/vulnerability/0a567730-5dd9-4bcb-b955-312979041466/ exploit vdb-entry technical-description