Pootle Button Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Pootle button allows Reflected XSS. This issue affects Pootle button: from n/a through 1.2.0.

Affected:

up to 1.2.0

Fix:

No patched version reported

Disclosed:

Jan 22, 2025

CVE-2025-23758 on NVD →

The Pootle button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully t...

CVSS:

6.1

Affected:

up to 1.2.0

Fix:

No patched version reported

Disclosed:

Jan 16, 2025

CVE-2025-23758 on NVD →

[en] The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Oct 23, 2017

CVE-2017-15811 on NVD →

Authenticated Cross-Site Scripting (XSS) vulnerability found in WordPress Pootle button plugin (versions <=1.1.1).

Affected:

up to 1.2.0

Fixed in:

1.2.0

Disclosed:

Oct 13, 2017

The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.

CVSS:

5.4

Affected:

up to 1.1.1

Fixed in:

1.2.0

Disclosed:

Oct 12, 2017

CVE-2017-15811 on NVD →