CVE-2026-9109: GPTranslate WordPress Plugin XSS Vulnerability

CVE-2026-9109 Overview

CVE-2026-9109 is a Stored Cross-Site Scripting (XSS) vulnerability in the GPTranslate – Multilingual AI Translation for WordPress plugin. The flaw affects all versions up to and including 2.31. The plugin fails to sanitize input and escape output when processing translation data submitted through its REST API endpoint at /wp-json/gptranslate/v1/request. Unauthenticated attackers can inject arbitrary JavaScript that executes whenever any user visits an affected page. The vulnerability is amplified by an insecure API key design: the plugin generates gptApiKey as a SHA-256 hash of the site URL and prints it in the HTML source of every page, exposing it to any visitor.

Critical Impact
Unauthenticated attackers can store JavaScript payloads that execute in every visitor's browser, enabling session hijacking, credential theft, and site defacement.

Affected Products

GPTranslate – Multilingual AI Translation for WordPress plugin versions ≤ 2.31
WordPress sites with the plugin's REST API endpoint exposed
Plugin file gptranslate.php and assets/js/admin.js in vulnerable releases

Discovery Timeline

2026-06-13 - CVE-2026-9109 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-9109

Vulnerability Analysis

The GPTranslate plugin exposes a REST API endpoint at /wp-json/gptranslate/v1/request that accepts translation payloads. The endpoint accepts and stores user-supplied translation content without sanitizing HTML or escaping output before rendering it back to page visitors. This classifies the issue under [CWE-79] Improper Neutralization of Input During Web Page Generation. Stored translation strings are later injected into rendered pages, where any embedded <script> tags or event handlers execute in the visitor's browser context.

Root Cause

Two design defects combine to make exploitation trivial. First, the plugin derives its API key deterministically as sha256(site_url) and emits it client-side through the gptApiKey JavaScript variable in the page HTML. Any unauthenticated visitor can read this key from the page source. Second, the translation request handler in gptranslate.php does not apply WordPress sanitization functions such as wp_kses_post() or escape output through esc_html() when storing or rendering translated content. The combination means there is no authentication boundary and no input filter between an attacker and persistent script storage.

Attack Vector

An attacker loads any public page of the target site, extracts the gptApiKey value from the HTML source, and sends a crafted POST request to /wp-json/gptranslate/v1/request containing a malicious translation payload with embedded JavaScript. The plugin stores the payload as a cached translation. When any legitimate user — including administrators — subsequently visits a page that triggers the stored translation, the injected script executes in their browser session. No authentication, user interaction, or social engineering is required for the initial injection.

Detection Methods for CVE-2026-9109

Indicators of Compromise

Unexpected POST requests to /wp-json/gptranslate/v1/request from unauthenticated sources
Translation cache entries containing <script>, onerror, onload, or javascript: strings
Outbound requests from visitor browsers to unfamiliar domains after page loads
Presence of the gptApiKey variable in HTML source paired with active GPTranslate plugin versions ≤ 2.31

Detection Strategies

Audit stored translation data in the WordPress database for HTML tags or JavaScript event handlers
Inspect web server access logs for POST traffic to the GPTranslate REST endpoint without prior authentication cookies
Deploy a Web Application Firewall (WAF) rule that blocks script-like payloads sent to /wp-json/gptranslate/v1/
Compare installed plugin version against the fixed release using wp plugin list via WP-CLI

Monitoring Recommendations

Alert on any modification to plugin translation cache tables or option rows
Monitor administrator session activity for anomalous DOM behavior or unexpected API calls
Track outbound HTTP requests originating from authenticated WordPress admin sessions

How to Mitigate CVE-2026-9109

Immediate Actions Required

Update the GPTranslate plugin to a version newer than 2.31 as soon as a patched release is available
Deactivate and remove the plugin if a patched version is not yet installable
Purge the plugin's translation cache to remove any previously injected payloads
Rotate WordPress administrator credentials and active session tokens if exploitation is suspected

Patch Information

At the time of publication, references point to plugin versions 2.27.5, 2.31, and 2.32 in the WordPress plugin repository. Administrators should consult the Wordfence Vulnerability Report for the confirmed fixed version and apply it through the WordPress plugin updater. Review the WordPress Plugin source code to validate that sanitization is applied to translation inputs in the deployed version.

Workarounds

Restrict access to /wp-json/gptranslate/v1/request via WAF or web server rules until a patch is applied
Remove the gptApiKey variable emission from page output by disabling front-end translation rendering
Apply a Content Security Policy (CSP) that restricts inline script execution to mitigate stored XSS impact

bash

# Example nginx rule to block the vulnerable REST endpoint
location ~ ^/wp-json/gptranslate/v1/request {
    return 403;
}