Loading story…
Transposh WordPress Translation plugin versions 1.0.7 and earlier contain a stored cross-site scripting vulnerability tracked as CVE-2021-24911. The unauthenticated tp_translation AJAX action accepted translation submissions without sufficient validation or sanitization, enabling an attacker to persist arbitrary JavaScript in translations.
The injected payload executes when users—including Subscribers, Editors, and Administrators—visit affected Transposh administrative pages, potentially enabling account compromise or actions performed in the victim’s browser. Transposh addressed the flaw in version 1.0.8; organizations should upgrade to 1.0.8.1 or later.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
RCE Security publicly disclosed CVE-2021-24911, describing the stored XSS issue affecting Transposh versions 1.0.7 and earlier and recommending an update to version 1.0.8.1.
The vendor released Transposh WordPress Translation version 1.0.8 to remediate CVE-2021-24911.
WPScan, acting as a CVE Numbering Authority, assigned CVE-2021-24911 to the Transposh stored cross-site scripting vulnerability.
RCE Security contacted the Transposh vendor, which acknowledged the reported vulnerability on the same day.
Julien Ahrens of RCE Security discovered and researched a stored cross-site scripting flaw in Transposh WordPress Translation versions 1.0.7 and earlier. The unauthenticated translation submission action could persist attacker-supplied JavaScript for execution in the plugin's administrative interface.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated vulnerability in the **TranslatePress – Translate Multilingual sites with AI Translation** WordPress plug-in can expose password-reset links and enable takeover of administrator accounts. Tracked as `CVE-2026-19632` (CVSS 9.8), the issue affects versions through 3.3.1 and results from a public AJAX endpoint, `trp_get_translations_regular`, returning translated password-reset email content stored in language dictionaries. Exploitation requires automatic string saving to be enabled and a targeted account—potentially an administrator—to use a published secondary language; attackers can then reset its password and gain full control of the site. TranslatePress version 3.3.2 fixes the flaw, which affects a plug-in installed on more than 400,000 sites. DigitalOcean honeypot telemetry has recorded exploitation attempts targeting WordPress plug-in weaknesses including this issue, increasing the urgency of patching and configuration reviews. Organizations should verify TranslatePress versions and update immediately; Wordfence released firewall protection to paid customers, while protection for free users is scheduled later. Administrators should also review exposure from the miniOrange SAML 2.0 single-sign-on plug-in, where `CVE-2026-15981` and `CVE-2026-61979` may allow unauthenticated `/wp-admin` access as arbitrary users, with patch visibility limited for several paid editions.
Aug 26, 2026
A vulnerability tracked as **CVE-2026-44990** allows stored cross-site scripting in `sanitize-html` when applications use the library’s default configuration and later render sanitized user content as trusted HTML. The flaw affects versions prior to **2.17.4** and stems from the handling of the disallowed `xmp` element: because `htmlparser2` treats `xmp` as a raw-text tag, attacker-supplied markup inside it is preserved as text during sanitization but can be emitted back as active HTML or JavaScript under the default `disallowedTagsMode: 'discard'` behavior. GitHub’s advisory and the upstream patch say the bypass can let payloads such as `<script>`, `img` event handlers, and `svg`-embedded script content survive filtering and execute in a victim’s browser. The fix in **2.17.4** adds `xmp` to `nonTextTags` so content inside a disallowed `xmp` tag is dropped instead of re-emitted, and regression tests were added to confirm the malicious content is removed. The issue was reported by **Vincenzo Turturro** (`sushi-gif`), and users of affected `sanitize-html` deployments, including those in **ApostropheCMS**, were urged to update immediately.
Jun 29, 2026
A critical stored cross-site scripting flaw in the open-source conference management platform **pretalx** exposed conference call-for-papers systems to organizer-session compromise. Tracked as **`CVE-2026-41241`** and rated **CVSS 8.7**, the bug allowed low-privileged attackers to place malicious HTML or JavaScript in searchable fields including submission titles, speaker display names, usernames, and email addresses. When an organizer searched for the tainted record, the payload could execute in that organizer’s browser, enabling theft of visible data, access to CSRF tokens, and authenticated actions that effectively granted organizer-level control. Researcher **Elad Meged** of Novee reported the issue after validating the vulnerable workflow across roughly 40 conferences without deploying live exploit payloads against real targets, while exploit testing was kept to controlled local environments. The report said attackers could also chain the bug with a Content Security Policy bypass by uploading a JavaScript payload disguised as presentation material, and described a no-JavaScript variant that could demote administrators via a superuser-demotion endpoint triggered from an embedded image tag. Pretalx developer Tobias Kunze said 11 findings were reported on April 14, with one deemed serious, and the project fixed the vulnerability in **`v2026.1.0`**; researchers also warned that agentic AI could help identify exposed pretalx instances and scale validation or exploitation.
Jun 29, 2026