Transposh Wordpress Translation
Approved changes feed: RSS · Atom
cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Transposh (c6dfa5c4-fb7c-5f18-85b8-b3340ad669af) |
|---|---|
| Product | Transposh Wordpress Translation (2fbd8e84-8ce2-59e6-82e4-ed1eaccdea13) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-2536 |
vulnerable | 2026-06-08 05:43:35.761710 |
Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass
MEDIUM (5.3)
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461.
Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
Published: 2022-12-15T04:01:45.987Z
Updated: 2026-04-08T17:21:25.403Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2462 |
vulnerable | 2026-06-08 05:43:35.597628 |
Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure
MEDIUM (5.3)
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
Published: 2022-09-06T17:18:57.000Z
Updated: 2026-04-08T17:18:51.712Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2461 |
vulnerable | 2026-06-08 05:43:35.597082 |
Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change
MEDIUM (5.3)
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
Published: 2022-09-06T17:18:58.000Z
Updated: 2026-04-08T16:41:36.744Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25812 |
vulnerable | 2026-06-08 05:41:49.500417 |
Transposh WordPress Translation < 1.0.8 - Admin+ RCE
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE
Published: 2022-08-22T14:59:06.000Z
Updated: 2024-08-03T04:49:43.741Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25811 |
vulnerable | 2026-06-08 05:41:49.500123 |
Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection
The Transposh WordPress Translation WordPress plugin through 1.0.8 does not sanitise and escape the order and orderby parameters before using them in a SQL statement, leading to a SQL injection
Published: 2022-08-22T14:58:47.000Z
Updated: 2024-08-03T04:49:44.141Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25810 |
vulnerable | 2026-06-08 05:41:49.499735 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24912 |
vulnerable | 2026-06-08 05:30:39.612867 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24911 |
vulnerable | 2026-06-08 05:30:39.612445 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24910 |
vulnerable | 2026-06-08 05:30:39.611921 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.