{"id":"CVE-2026-103309","published":"2026-10-08T06:16:37.287","lastModified":"2026-10-08T20:51:18.123","description":"The GPTranslate  WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e791e349-932b-4e59-bacb-a49b57343cf3/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The GPTranslate WordPress plugin has a stored XSS vulnerability that allows unauthenticated users to inject malicious scripts into translated pages. This occurs because the plugin doesn't properly restrict who can store translations and fails to escape output when displaying them.","exploitability":"Exploitation is moderately difficult as it requires server-side translations to be enabled, but once enabled, unauthenticated users can inject XSS payloads that execute in the context of authenticated users' browsers.","blast_radius":"The impact could be significant as attackers could steal user sessions, perform actions on behalf of users, or redirect them to malicious sites when they view translated content pages.","remediation":"Upgrade to GPTranslate plugin version 2.34.14 or later to remediate the stored XSS vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","wordpress","plugin","stored-xss"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:02:08.583Z"}}