MediumPublic exploit

Stored Cross-Site Scripting in Transposh WordPress Translation

IdentifiersCVE-2021-24911CWE-79· Improper Neutralization of Input…

CVE-2021-24911 is a stored cross-site scripting vulnerability in Transposh WordPress Translation versions 1.0.7 and earlier. The tp_translation AJAX action fails to adequately validate, sanitize, and contextually escape the tk0 translation parameter. An attacker can submit a translation containing JavaScript that is stored by the plugin and rendered in its administrative translation-management interfaces, including the main and editor views.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker can persist arbitrary JavaScript that executes in the browser of a user visiting affected Transposh administrative pages. Consequences include administrative-session actions performed through the victim’s browser, interface or content spoofing, redirects, and exfiltration of data accessible to the victim’s session. In configurations permitting anonymous translation submissions, exploitation can be initiated without authentication; execution still requires an affected user to visit a vulnerable administrative interface.

Mitigation

If you can’t patch tonight, do this now.

Until the plugin is upgraded, disable or restrict translation submission through the tp_translation AJAX functionality, configure the plugin’s “Who can translate?” setting to require trusted users, and limit access to Transposh administrative pages. Review stored translations for malicious markup and remove suspicious entries. Administrators who may have viewed affected pages should invalidate active sessions and review administrative actions.

Remediation

Patch, then assume compromise.

Upgrade Transposh WordPress Translation to a fixed release. Version 1.0.8 introduced a fix; upgrading to version 1.0.8.1 or later is recommended.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

TransposhTransposh Wordpress Translationapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

rcesecurity blogNews

Jul 22, 2022

WordPress Transposh: Exploiting a Blind SQL Injection via XSS

An unauthenticated stored XSS vulnerability in the Transposh Translation Filter WordPress plugin that allows arbitrary JavaScript to be injected into the admin backend and executed when an administrator visits affected pages.

rcesecurity blogNews

Jul 22, 2022

CVE-2021-24911 Transposh <= 1.0.7 … | RCE Security

A stored cross-site scripting vulnerability in Transposh WordPress Translation versions 1.0.7 and earlier. An unauthenticated attacker can submit a malicious translation through the tp_translation AJAX action; the injected JavaScript is persistently rendered in Transposh administrative pages.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity