Loco Translate

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators. The authoritative export identifies the fixed release as 2.8.9.

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root. The authoritative export does not name the individual route, parameter or permitted file types. The authoritative export identifies the fixed release as 2.8.9.

Loco Translate through 2.8.7 does not adequately sanitize and escape extracted comments imported from PO files. A user with Translator-level access can place a script payload in an extracted comment, and it executes when a user views the affected translation interface. The public.

Loco Translate 2.8.5 and earlier does not correctly validate the request reaching execTemplate. A forged administrator request can supply a php://filter-style stream wrapper as template input and reach a PHP include operation, turning CSRF into server-side code execution.

Loco Translate is affected by filesystem traversal. Exploitation requires an authenticated WordPress account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 2.8.2.

Loco Translate is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 2.8.2.

Loco Translate is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Loco Translate is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Loco Translate is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.