CVE-2015-10092 json
Qtranslate Slug Plugin class-qtranslate-slug.php add_slug_meta_box cross site scripting
published 2023-03-06 3 y ago modified 2026-06-17 4 mo ago also EUVD-2015-1102
- cvss
- 3.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function add_slug_meta_box of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.1.17 is able to address this issue. The name of the patch is 74b3932696f9868e14563e51b7d0bb68c53bf5e4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222324.
Patch / fix
- qtranslate_slug_project qtranslate_slug 1.1.17
Exploit prediction
0.56% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected products
- n/a Qtranslate Slug Plugin
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
References
-
github.com
/wp-plugins/qtranslate-slug/commit/74b3932696f9868e14563e51b7d0bb68c53bf5e4
patch
-
github.com
/wp-plugins/qtranslate-slug/releases/tag/1.1.17
patch, release-notes
-
vuldb.com
/?id.222324
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.222324
signature, permissions-required, third-party-advisory
Sources
- CVE List CVE-2015-10092
- NVD CVE-2015-10092
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.