CVE-2026-103309

UNKNOWN 0.0

GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.

Vendor	unknown
Product	gptranslate
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for unknown gptranslate

Be the first to know when new unknown vulnerabilities affecting unknown gptranslate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / GPTranslate

0 < 2.34.14

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/e791e349-932b-4e59-bacb-a49b57343cf3/

Credits

Guntur Wahyu Ramadhan WPScan