Description
The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Published: 2025-05-15
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-15253 The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
History

Tue, 27 May 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Ryanchristenson
Ryanchristenson babeiz
Weaknesses CWE-79
CPEs cpe:2.3:a:ryanchristenson:babeiz:*:*:*:*:*:wordpress:*:*
Vendors & Products Ryanchristenson
Ryanchristenson babeiz

Tue, 20 May 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 May 2025 20:15:00 +0000

Type Values Removed Values Added
Description The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Title BabelZ – Google Translate Widget <= 1.1.5 - CSRF to Stored XSS
References

Subscriptions

Ryanchristenson Babeiz
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2025-05-20T19:19:47.523Z

Reserved: 2024-08-22T13:54:13.287Z

Link: CVE-2024-8095

cve-icon Vulnrichment

Updated: 2025-05-19T20:24:30.468Z

cve-icon NVD

Status : Analyzed

Published: 2025-05-15T20:15:57.937

Modified: 2026-06-17T08:21:51.743

Link: CVE-2024-8095

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')