CVE-2026-9109 describes a stored cross-site scripting vulnerability in the GPTranslate – Multilingual AI Translation for WordPress plugin, affecting all versions up to and including 2.31. The vulnerability arises from insufficient input sanitization and output escaping in the REST API Translation Storage endpoint. The plugin exposes a deterministic API key (sha256 of the site URL) in the HTML source via the JavaScript variable gptApiKey, enabling unauthenticated attackers to submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint. This allows injection of arbitrary web scripts that execute in the context of users visiting the affected pages.

An unauthenticated attacker can inject and store malicious scripts via the REST API, which execute in the browsers of users visiting the affected site. This can lead to information disclosure (such as theft of cookies or session tokens) and potential user impersonation or other client-side impacts. The exposure of the API key in page source lowers the barrier to exploitation by removing authentication requirements for submitting malicious payloads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the GPTranslate plugin or restricting access to the REST API endpoints if possible. Monitor official channels for updates and apply patches promptly once released.