CVE-2026-103309 — GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowi…
Published: 2026-10-08 · CVSS: 7.5 · CVSS 3.1
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7