CVE-2022-0765

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-07669.8Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.CVE-2022-07679.9Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.CVE-2022-07689.1Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.CVE-2022-07699.8The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolat CVE-2022-07708.8The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as u CVE-2022-07719.8The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL state CVE-2022-07724.8Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.CVE-2022-07739.8The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement an CVE-2022-07754.3The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenti CVE-2022-07766.1Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.CVE-2022-07777.5Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.CVE-2022-07787.5The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Int