CVE-2026-103309: GPTranslate WordPress Plugin XSS Vulnerability

CVE-2026-103309 Overview

CVE-2026-103309 is a Stored Cross-Site Scripting (XSS) vulnerability in the GPTranslate WordPress plugin versions prior to 2.34.14. The plugin fails to restrict who can store translations and does not escape translated content when rendering it in pages. Unauthenticated attackers can inject malicious JavaScript into stored translations when server-side translations are enabled. The payload executes in the browser of any visitor viewing an affected translated page. The flaw is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into translated pages, enabling session theft, administrative account takeover, and arbitrary actions in the context of visiting users.

Affected Products

GPTranslate WordPress plugin versions prior to 2.34.14
WordPress sites with the GPTranslate plugin installed and server-side translations enabled
Any site visitor rendering an affected translated page

Discovery Timeline

2026-10-08 - CVE-2026-103309 published to the National Vulnerability Database
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-103309

Vulnerability Analysis

The GPTranslate plugin provides translation functionality for WordPress sites, including a server-side translation mode that caches translated content. The vulnerability stems from two compounding weaknesses in how the plugin handles translation data. First, the endpoint responsible for storing translation entries does not verify the identity or permissions of the requester. Second, the plugin outputs stored translations directly into page HTML without applying contextual output escaping.

An unauthenticated attacker can submit crafted translation payloads containing HTML and JavaScript. Those payloads persist in the plugin's translation store. When a subsequent visitor loads the translated version of the page, the browser renders the attacker-controlled markup and executes any embedded script. Refer to the WPScan Vulnerability Detail for the full technical write-up.

Root Cause

Two defects combine to produce the vulnerability. The translation-storage handler lacks a capability check and nonce validation, letting any anonymous caller write entries. The translation-rendering path omits esc_html() or equivalent escaping when inserting stored strings into output HTML. Together these violate the WordPress plugin security guidance for both authorization and output encoding.

Attack Vector

Exploitation requires that server-side translations are enabled on the target site. An attacker sends a crafted request to the translation-storage endpoint containing a JavaScript payload embedded in a translation value. The payload is stored server-side and served to every visitor who requests the corresponding translated page. The attack requires user interaction only in the sense that a victim must load the translated page. Successful execution runs attacker-controlled script in the visitor's session, including sessions of authenticated administrators.

No verified public proof-of-concept code is available at the time of writing. See the WPScan advisory for additional detail.

Detection Methods for CVE-2026-103309

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings present in GPTranslate database tables or translation cache files
Anonymous POST requests to GPTranslate translation-storage endpoints from unfamiliar IP addresses
Browser console errors or outbound requests to unknown domains from translated pages
WordPress administrator sessions originating from unexpected geolocations following page views of translated content

Detection Strategies

Inspect stored translation entries for HTML tags, event handlers, or URL schemes other than http/https
Deploy web application firewall rules to flag requests to translation endpoints that contain script-like characters from unauthenticated sources
Review WordPress access logs for repeated unauthenticated POSTs to GPTranslate REST or admin-ajax routes
Correlate anomalous JavaScript execution on front-end pages with recent translation-store writes

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and admin-ajax.php to capture translation-related calls
Monitor file-integrity and database-change events for the plugin's translation storage
Alert on administrative account changes, new user creation, and plugin installations following suspicious translation requests
Track outbound DOM-initiated network calls from translated pages using browser-side monitoring where available

How to Mitigate CVE-2026-103309

Immediate Actions Required

Update the GPTranslate plugin to version 2.34.14 or later on all WordPress sites
If immediate patching is not possible, disable server-side translations in the plugin configuration
Audit the translation store for existing malicious entries and purge any that contain script content
Rotate credentials for administrative WordPress accounts that may have viewed poisoned translated pages

Patch Information

The vendor addressed the issue in GPTranslate version 2.34.14 by adding proper authorization checks on the translation-storage path and applying output escaping when rendering translations. Site operators should update through the WordPress plugin dashboard or by replacing the plugin files from the official source. Confirm the installed version after update via the Plugins screen.

Workarounds

Disable the GPTranslate plugin entirely until the patched version can be deployed
Turn off the server-side translations feature, which is the precondition for exploitation
Deploy a web application firewall rule to block unauthenticated writes to translation endpoints
Restrict access to the WordPress REST API and admin-ajax.php endpoints by IP where feasible

bash

# Verify installed GPTranslate version from WP-CLI
wp plugin get gptranslate --field=version

# Update GPTranslate to the patched release
wp plugin update gptranslate --version=2.34.14

# Temporarily deactivate the plugin if update cannot be applied immediately
wp plugin deactivate gptranslate