CVE-2026-103309

HighCVSS 7.5

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.

Risk Assessment

XSS attacks can lead to session theft, compromise of administrator accounts, and modification of page content, threatening site integrity and reputation.

Recommendation

Update the GPTranslate plugin to version 2.34.14 or later. If not possible, consider disabling server-side translations.

Other vulnerabilities in GPTranslate WordPress plugin

CVE-2026-89278Medium
The GPTranslate plugin for WordPress in all versions up to and including 2.34.6 is vulnerable to Sensitive Information Exposure via enqueue_frontend_scripts. Unauthenticated attackers can extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This affects the default configuration and all supported non-DeepSeek providers.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS