CVE-2025-15695: GTranslate WordPress Plugin XSS Vulnerability

CVE-2025-15695 Overview

CVE-2025-15695 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Translate WordPress with GTranslate plugin for WordPress. Versions prior to 3.0.10 fail to validate one of the plugin's settings before bundled front-end scripts use it to build markup. An authenticated user with administrator privileges can store JavaScript that executes in the browser session of any visitor to the affected site. The flaw affects the client-side rendering path rather than the server-side output pipeline. Exploitation requires both high privileges and user interaction on the victim side.

Critical Impact
An administrator-level account can persist JavaScript that runs against every site visitor, enabling session interaction, UI manipulation, or redirection within the visitor's browser context.

Affected Products

Translate WordPress with GTranslate plugin versions prior to 3.0.10
WordPress sites with the affected plugin installed and activated
Site visitors whose browsers render pages containing the tainted setting value

Discovery Timeline

2026-09-11 - CVE-2025-15695 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2025-15695

Vulnerability Analysis

The vulnerability resides in the plugin's front-end JavaScript, which consumes a plugin setting and inserts its value into the Document Object Model (DOM) without sanitization or encoding. Because the value originates from a plugin configuration field that an administrator controls, any script payload stored there becomes persistent. Every subsequent page render delivers the payload to visitors, where it executes in the site's origin.

This is a stored (persistent) XSS pattern with a client-side sink. The plugin trusts configuration input as safe markup input, which violates output-encoding requirements for values rendered into HTML contexts. The issue is limited by the requirement that the attacker already hold administrator privileges and that a visitor interact with the affected page.

Root Cause

The root cause is missing input validation and output encoding on a plugin setting before it is passed to a DOM construction routine in the bundled front-end scripts. The plugin treats an administrator-supplied string as trusted markup, so any embedded <script> element or event-handler attribute is honored by the browser at render time.

Attack Vector

An authenticated administrator submits a crafted payload through the vulnerable plugin setting in the WordPress admin console. The plugin persists the value in the site database. When a visitor loads a page that invokes the affected front-end script, the browser parses the injected markup and executes the attacker's JavaScript in the site's origin. The attack requires network access to the WordPress admin interface and visitor interaction with a rendered page.

For implementation details, see the WPScan Vulnerability Report.

Detection Methods for CVE-2025-15695

Indicators of Compromise

Plugin settings entries in the wp_options table containing <script> tags, javascript: URIs, or inline event handlers such as onerror= or onload=
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that load GTranslate front-end scripts
Recent administrator logins from unfamiliar IP addresses correlated with plugin configuration changes

Detection Strategies

Inventory WordPress installations and identify hosts running Translate WordPress with GTranslate at versions below 3.0.10
Review audit logs for changes to GTranslate plugin settings, particularly after administrator credential events
Scan rendered HTML for the plugin's known DOM insertion points to detect anomalous script content served to visitors

Monitoring Recommendations

Alert on modifications to WordPress plugin options containing HTML or JavaScript syntax in fields that should hold plain configuration values
Monitor administrator account activity for unusual session sources, off-hours logins, and privilege changes
Track browser-side Content Security Policy (CSP) violation reports for the WordPress site origin

How to Mitigate CVE-2025-15695

Immediate Actions Required

Update the Translate WordPress with GTranslate plugin to version 3.0.10 or later on every affected site
Audit GTranslate plugin settings and remove any values containing HTML tags, script elements, or event-handler attributes
Review administrator accounts, rotate credentials for any suspected compromise, and enforce multi-factor authentication

Patch Information

The vendor addressed the issue in Translate WordPress with GTranslate version 3.0.10. Upgrade the plugin through the WordPress admin dashboard or via wp-cli. Confirm the installed version matches or exceeds 3.0.10 after the update. Reference: WPScan Vulnerability Report.

Workarounds

Restrict administrator access to trusted personnel and remove unused privileged accounts until the plugin is updated
Deploy a Content Security Policy that disallows inline scripts on public-facing pages to reduce the impact of stored XSS payloads
Disable or uninstall the plugin on sites where translation functionality is not required until patching is complete

bash

# Update the plugin using wp-cli
wp plugin update gtranslate
wp plugin get gtranslate --field=version