Threats tagged 'ghsa-c4w7-c635-cvqq'

The TranslatePress plugin for WordPress versions up to and including 3.3.8 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that the attacker's comment is previously approved under WordPress's default moderation and that a secondary language is configured in TranslatePress.