Stored Cross-Site Scripting in The Transliterator WordPress Plugin

The Transliterator - Multilingual and Multi-script Text Conversion plugin for WordPress (all versions up to and including 2.5.8) contains a stored cross-site scripting (XSS) vulnerability. The flaw arises due to insufficient input sanitization and output escaping when processing comment content. Unauthenticated attackers can exploit this by injecting payloads that leverage the plugin's predictable {rstr_keep} placeholder token. Because the WordPress core 'kses' allow-list permits specific HTML tags and attributes (such as 'a' with the 'title' attribute and 'code' tags), the malicious payloads bypass standard save-time sanitization routines. When a site administrator or visitor views a comment containing the injected script, the payload executes within the victim's browser session. This vulnerability poses a significant risk for session hijacking, unauthorized actions performed on behalf of authenticated users, and defacement of the affected WordPress site.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browser of any user who views the compromised content. This may lead to the theft of session cookies (enabling account takeover), forced redirection to malicious domains, or unauthorized administrative actions if an authenticated WordPress user views the comment.

Recommendation

• Update The Transliterator plugin to a version released after 2.5.8 immediately.
• If a patched version is not available, disable the plugin or restrict comment submission capabilities for unauthenticated users as a temporary mitigation.
• Implement a strict Content Security Policy (CSP) to mitigate the impact of XSS vulnerabilities by restricting the sources of executable scripts.
• Monitor server-side web application logs for unusual POST requests directed at comment submission endpoints that contain suspicious HTML attributes or script tokens.