CVE-2026-9109
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The GPTranslate – Multilingual AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via REST API Translation Storage in all versions up to and including 2.31 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.
Risk Assessment
Attackers can exploit this vulnerability to inject malicious scripts, potentially leading to user data theft or session hijacking. Organizations may face reputational damage and legal consequences related to data breaches.
Recommendation
It is recommended to update the GPTranslate plugin to the latest version to mitigate this vulnerability. Additionally, implementing security measures such as Content Security Policy (CSP) can help reduce the risk of XSS attacks.
Original NVD description (English source)
The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The deterministically derived API key (sha256 of the site URL) is printed in the HTML source of every page via the JavaScript variable gptApiKey, meaning any unauthenticated visitor can retrieve the key and submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint without any additional precondition.