GPTranslate <= 2.34.12 - Unauthenticated Stored Cross-Site Scripting via Translated Attributes in the DOMDocument Rendering Method
- ID
- WPSEC-2026-0405
- Plugin
- GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI (gptranslate)
- Affected
- all versions before 2.34.13
- Remediation
- Update to 2.34.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GPTranslate on WPSec AttackSurface
- Fix released
- Published
Description
The GPTranslate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via translated image alt, title, src and srcset attributes, iframe and video src attributes, and meta description content in all versions up to, and including, 2.34.12. The public REST endpoint /wp-json/gptranslate/v1/request accepts the 'storetranslations' task from any visitor, because its API secret and wp_rest nonce are printed into every front-end page, and stored values are at most stripped of HTML tags, which leaves quote characters intact. When server-side translations use the DOMDocument method (not the default), the plugin writes these values into attributes with setAttribute() without esc_attr() and then entity-decodes the serialized page, so quote characters in a translated value are not neutralized. This makes it possible for unauthenticated attackers to break out of the attribute and inject arbitrary web scripts in translated pages that will execute whenever a user accesses an injected page. Version 2.34.12 fixed the same issue only in the other replacement methods.
References
- https://wpsec.com/vuln/WPSEC-2026-0405/
- https://plugins.svn.wordpress.org/gptranslate/tags/2.34.13/
- https://wordpress.org/plugins/gptranslate/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS