Junglewise Threat Intelligence

CVE-2026-9109: GPTranslate WordPress plugin stored XSS via REST API translation storage

CVE-2026-9109 · Severity: high · CVSS 7.2 · Published 2026-06-13

Executive brief

The GPTranslate plugin for WordPress, which provides automated AI-driven website translations, contains a security flaw that allows unauthorized individuals to inject malicious scripts into a website. By exploiting a predictable security key visible to any visitor, an attacker can modify stored translations to include harmful code. This could lead to website defacement, theft of visitor information, or unauthorized actions performed in the context of a user's browser session.

Technical details

The GPTranslate plugin for WordPress (versions up to 2.31) is vulnerable to Stored Cross-Site Scripting (XSS) via the '/wp-json/gptranslate/v1/request' REST API endpoint. The vulnerability stems from insufficient sanitization of translation data and a lack of output escaping. Authentication is bypassed because the required API key is deterministically generated (SHA256 of the site URL) and exposed in the HTML source via the 'gptApiKey' JavaScript variable. An unauthenticated attacker can retrieve this key, submit malicious scripts as translation payloads, and achieve persistent script execution in the browsers of site visitors. Version 2.32 appears to contain relevant code changes to address the issue.

Affected products

  • GPTranslate GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites Up to and including 2.31

Timeline

  • 2026-06-13: disclosed: Initial disclosure by Wordfence and NVD publication.

References

Related threats