Description

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/e791e349-932b-4e59-bacb-a49b57343cf3/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-79

CVSS impact metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

7.5 · High

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-08T06:16:37.287Z

26 hours ago

Last modified

2026-10-08T20:51:18.123Z

12 hours ago