CVE-2026-103309

Summary

The GPTranslate WordPress plugin has a stored XSS vulnerability that allows unauthenticated users to inject malicious scripts into translated pages. This occurs because the plugin doesn't properly restrict who can store translations and fails to escape output when displaying them.

Exploitability

Exploitation is moderately difficult as it requires server-side translations to be enabled, but once enabled, unauthenticated users can inject XSS payloads that execute in the context of authenticated users' browsers.

Blast radius

The impact could be significant as attackers could steal user sessions, perform actions on behalf of users, or redirect them to malicious sites when they view translated content pages.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to GPTranslate plugin version 2.34.14 or later to remediate the stored XSS vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.