CVE-2026-103309 in GPTranslate Plugin
Summary
by MITRE • 10/08/2026
The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in GPTranslate versions prior to 2.34.14 represents a critical security flaw rooted in insufficient access control and inadequate input sanitization within the WordPress plugin ecosystem. This specific issue allows unauthenticated users, who do not possess valid administrative credentials or any user account on the target website, to inject malicious scripts into the application's translation storage mechanism. The core of the problem lies in the plugin's failure to properly restrict which entities are permitted to store translations. In a secure implementation, only authenticated administrators should have the privilege to modify site-wide content such as translated strings. However, due to this misconfiguration, the attack surface is expanded significantly, exposing sensitive backend functionality to public internet traffic without any authentication barrier.
The technical execution of this vulnerability involves two distinct phases: storage and rendering. First, an attacker crafts a malicious payload containing JavaScript code disguised as legitimate translation data or metadata. Because the plugin does not verify the identity or permissions of the user submitting this data, the server accepts and stores the input in its database without validation. This constitutes a classic Stored Cross-Site Scripting (XSS) vector where the malicious content persists on the web server rather than being transiently passed via URL parameters or form fields that are immediately discarded after processing. The persistence of this payload ensures that every subsequent user interaction with the affected pages will trigger the execution of the injected code, thereby amplifying the potential impact far beyond a single session.
The second phase involves the output handling mechanism within GPTranslate. When translated pages are rendered for visitors, the plugin retrieves the stored translations and displays them on the frontend interface. Crucially, the plugin fails to escape these outputs properly before rendering them in the browser context. This lack of encoding means that any special characters or script tags contained within the malicious translation data are interpreted by the user's web browser as executable code rather than plain text. Consequently, when a legitimate visitor loads a page containing the compromised translation, their browser executes the attacker's JavaScript payload in the security context of the target website. This allows the attack to bypass same-origin policy restrictions and interact directly with the site's Document Object Model (DOM).
The operational impact of this vulnerability is severe, primarily because it enables unauthenticated attackers to achieve arbitrary code execution within the victim's browser session. Once the script executes, an attacker can perform a variety of malicious actions depending on their objectives. These include stealing administrative cookies or authentication tokens through document.cookie access, redirecting users to phishing sites designed to harvest credentials, defacing the website by modifying its visual presentation, or performing actions on behalf of authenticated administrators if they visit the compromised page while logged in. This effectively compromises the confidentiality and integrity of the web application, potentially leading to full site takeover if administrative privileges are obtained through session hijacking techniques facilitated by the XSS payload.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) due to the failure to sanitize and escape user input before rendering it in HTML. Furthermore, the lack of proper access control for storing translations corresponds to CWE-284: Improper Access Control, as unauthenticated users are granted privileges that should be restricted to authorized administrators. In terms of tactical mapping within the MITRE ATT&CK framework, this vulnerability facilitates Initial Execution and Collection techniques, specifically leveraging browser-based execution to harvest credentials or maintain persistence through stored payloads. The attack vector is classified as Network with Low Complexity since it requires no prior authentication and can often be automated using standard web scraping or fuzzing tools.
To mitigate this risk, immediate action must be taken by updating the GPTranslate plugin to version 2.34.14 or later, where these access control checks and output escaping mechanisms have been corrected. Administrators should verify that their WordPress installation is fully patched and consider implementing a Web Application Firewall (WAF) as an additional layer of defense to filter out malicious payloads attempting to exploit known vulnerabilities in plugins. For developers maintaining custom integrations with GPTranslate or similar translation tools, it is imperative to enforce strict server-side validation ensuring that only authenticated users with the appropriate capabilities can modify translation data. Additionally, all dynamic content outputted by WordPress plugins must be passed through proper escaping functions such as esc_html() or wp_kses_post() to ensure that any stored user input is rendered safely and cannot execute arbitrary scripts in client browsers. Regular security audits and code reviews focusing on input validation and authorization checks are essential practices to prevent similar vulnerabilities from being introduced into the application logic.