Wpdeepl Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.1.4 versions.

Affected:

up to 2.1.5

Fixed in:

2.1.5

Disclosed:

Nov 22, 2023

CVE-2023-27446 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.3.9.1 versions.

Affected:

up to 2.4.1.2

Fixed in:

2.4.1.2

Disclosed:

Nov 13, 2023

CVE-2023-46620 on NVD →

The DeepL Pro API translation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.1.1. This is due to missing or incorrect nonce validation on the wpdeepl_prune_logs function. This makes it possible for unauthenticated attackers to trigger the log pruning feature via a...

CVSS:

4.3

Affected:

up to 2.4.1.1

Fixed in:

2.4.1.2

Disclosed:

Oct 25, 2023

CVE-2023-46620 on NVD →

The DeepL Pro API translation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.4. This is due to missing or incorrect nonce validation on the 'saveSettings' function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request...

CVSS:

4.3

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

Mar 2, 2023

CVE-2023-27446 on NVD →

[en] The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.

Affected:

up to 1.7.5

Fixed in:

1.7.5

Disclosed:

Nov 21, 2022

CVE-2022-3691 on NVD →

The DeepL Pro API Translation plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 1.7.4. This could allow unauthenticated attackers to extract sensitive user or configuration data such as API keys.

CVSS:

6.5

Affected:

up to 1.7.4

Fixed in:

1.7.5

Disclosed:

Oct 31, 2022

CVE-2022-3691 on NVD →