GPTranslate <= 2.34.10 - Unauthenticated Stored Cross-Site Scripting via Translation Values
- ID
- WPSEC-2026-0139
- Plugin
- GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI (gptranslate)
- Affected
- all versions before 2.34.11
- Remediation
- Update to 2.34.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GPTranslate on WPSec AttackSurface
- Fix released
- Published
Description
The GPTranslate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via translation values in all versions up to, and including, 2.34.10. The public REST endpoint /wp-json/gptranslate/v1/request accepts the 'storetranslations' task from any visitor, because its only checks are an API secret and a wp_rest nonce that the plugin prints into every front-end page, and it stored the submitted translation values without sanitization. When server-side translations are enabled, those values are substituted into the page HTML without escaping by the regex (default) and str_ireplace replacement methods. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in translated pages that will execute whenever a user accesses an injected page. Version 2.32 addressed an earlier report of this issue only by hardening the admin translation editor and replacing the API secret, which remained publicly exposed.
References
- https://wpsec.com/vuln/WPSEC-2026-0139/
- https://plugins.svn.wordpress.org/gptranslate/tags/2.34.11/
- https://wordpress.org/plugins/gptranslate/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS