Google Language Translator Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2021-4452

Summary

The Google Language Translator plugin for WordPress displays vulnerabilities that expose authenticated users to the risk of Reflected Cross-Site Scripting. This occurs through multiple parameters that lack sufficient sanitization and proper output escaping. Attackers can leverage this weakness to inject arbitrary web scripts that can be executed upon tricking a user into engaging with a crafted link. The issue is particularly concerning for users with older web browsers, which may not adequately handle URL encoding, amplifying the risk of successful exploitation.

References