Kau Boys Backend Localization Vulnerabilities

The Backend Localization plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.10. This is due to missing or incorrect nonce validation on the backend_localization_admin_settings() function. This makes it possible for unauthenticated attackers to modify the plugin's sett...

CVSS:

4.3

Affected:

up to 2.1.10

Fix:

No patched version reported

Disclosed:

Sep 29, 2023

CVE-2023-44471 on NVD →

The Backend Localization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'kau-boys_backend_localization_language' parameter in versions up to, and including, 2.0 due to a lack of sanitization and escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVSS:

6.1

Affected:

up to 2.0

Fixed in:

2.0.1

Disclosed:

Jul 30, 2012

CVE-2012-10014 on NVD →

The Backend Localization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in versions up to, and including, 1.9. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they...

CVSS:

6.1

Affected:

1.6.1 – 1.6.1

Fixed in:

2.0

Disclosed:

Jul 30, 2012

CVE-2012-10013 on NVD →