Medium severity · published Apr 20, 2020
CVE-2020-11930
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link
6.1
CVSS
4.5%
EPSS
No
On KEV
Description
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)4.5% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Translate Wordpress With Gtranslate · Gtranslate
before 2.8.52 · source: NVD
Affected product
TW
Translate Wordpress With Gtranslate
Gtranslate
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11930
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11930
Patch
https://plugins.trac.wordpress.org/changeset/2245581/gtranslate
Patch
https://plugins.trac.wordpress.org/changeset/2245591/gtranslate
Product
https://wordpress.org/plugins/gtranslate/#developers
wpvulndb.com
https://wpvulndb.com/vulnerabilities/10181
More from Translate Wordpress With Gtranslate
8.8
CVE-2022-0770
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible…
4.8
CVE-2023-4502
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
4.7
CVE-2021-25103
The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting…