CVE-2021-34630 Scanner
CVE-2021-34630 Scanner - Cross-Site Scripting (XSS) vulnerability in GTranslate
Short Info
Level
Medium
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
3 weeks 2 hours
Scan only one
URL
Toolbox
-
The GTranslate plugin is used by website administrators to enable automatic language translation services on WordPress-powered websites. It is popular among small to medium-sized businesses and content creators aiming to reach multilingual audiences. The Pro and Enterprise versions offer additional features like enhanced translation accuracy and support for multiple languages.
The vulnerability detected allows attackers to execute malicious scripts in the context of a user's browser session. This happens because the `gtranslate_request_uri_var` function improperly sanitizes the contents of the `$_SERVER['REQUEST_URI']` variable in specific conditions, such as older browser usage or interception of the request by an attacker.
The issue is tied to improper handling of user-provided input within the request URI. Despite using `addslashes`, older browsers or non-standard client-server interactions expose the reflected XSS flaw. It affects endpoints where the `gtranslate_request_uri_var` function is invoked on WordPress pages.
Exploitation of this vulnerability could result in attackers injecting scripts that steal user data, hijack sessions, or perform malicious redirections. The flaw requires user interaction, such as visiting a crafted link, to be triggered successfully.
REFERENCES