CVE-2026-103309: CWE-79 Cross-Site Scripting (XSS) in GPTranslate
Description
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.
CVSS v3.1
Score 7.5high
Affected software
GPTranslate
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The GPTranslate WordPress plugin prior to version 2.34.14 allows unauthenticated users to perform stored cross-site scripting attacks due to improper access control on storing translations and lack of output escaping on translated pages. This vulnerability arises when server-side translations are enabled, enabling injection of malicious scripts that are stored and later executed in the context of users viewing translated content.
Potential Impact
An attacker can inject malicious scripts that are stored by the plugin and executed in the browsers of users viewing translated pages. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability affects unauthenticated users, increasing the risk of exploitation. However, no known exploits in the wild have been reported to date.
Mitigation Recommendations
Upgrade the GPTranslate plugin to version 2.34.14 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, applying this official fix is the recommended remediation. No other mitigation steps are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-30T11:35:59.238Z
- State
- PUBLISHED
Threat ID: 6ac735da2cdf04f656f03e9c
Added to database: 10/08/2026, 06:19:06 UTC
Last enriched: 10/08/2026, 06:34:35 UTC
Last updated: 10/08/2026, 18:48:43 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.