Security readout for executives and security teams
Plain-English summary
A vulnerable WordPress translation plugin can echo attacker-supplied input back into a browser without proper sanitization. This creates reflected cross-site scripting risk, where a user following a malicious link could run attacker-controlled script in the context of the affected site.
Executive priority
Treat as a near-term WordPress hygiene item, not an emergency based on supplied evidence. Prioritize public sites, sites with privileged user traffic, and environments where plugin inventory is weak.
Technical view
Transposh WordPress Translation before 1.0.8 fails to sanitize and escape the AJAX action parameter named `a` before returning it in the response. The source states the action is reachable by unauthenticated and authenticated users when PHP cURL support is installed, causing CWE-79 reflected XSS.
Likely exposure
Exposure is limited to WordPress sites running Transposh WordPress Translation versions before 1.0.8, especially where the cURL library is installed. Internet-facing WordPress sites have higher practical exposure because reflected XSS usually depends on victim interaction.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The issue is still externally reachable under the stated conditions, but exploitation evidence is incomplete in the supplied bundle.
Researcher notes
The key research detail is unauthenticated AJAX reachability when cURL is installed. The supplied data does not include CVSS, exploit status, or detailed patch notes beyond the before-1.0.8 affected range.
Mitigation direction
- Inventory WordPress sites for Transposh WordPress Translation installations.
- Upgrade the plugin to 1.0.8 or later where installed.
- Disable or remove the plugin if upgrade status cannot be confirmed.
- Check WPScan and vendor guidance for current support status.
Validation and detection
- Confirm installed plugin versions across all WordPress environments.
- Verify whether PHP cURL is enabled on affected hosts.
- Review web logs for suspicious AJAX requests targeting the plugin.
- Confirm remediation by retesting version and plugin presence only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-24910 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/b5cbebf4-5749-41a0-8be3-3333853fca17CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.