Description

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-11T07:16:44.617Z",
  "pubdate": "2026-09-11T07:16:44.617Z",
  "executiveSummary": "The GTranslate WordPress plugin prior to version 3.0.10 contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient input validation. The vulnerability resides in the plugin's settings configuration, where administrative users can inject arbitrary JavaScript payloads. This malicious code is subsequently rendered within the markup of the front-end interface, executing in the context of any visitor's browser session. The vulnerability allows an authenticated attacker with administrative privileges to compromise the integrity and confidentiality of visitor sessions, potentially leading to unauthorized actions, credential theft, or further client-side exploitation. While the attack requires administrative-level access, the impact is global, affecting any site visitor who interacts with the compromised front-end components. Remediation requires an immediate update to version 3.0.10 or higher to ensure proper sanitization of settings input.",
  "technicalDetails": "The vulnerability originates from the improper handling of plugin settings within the GTranslate WordPress plugin. Specifically, the component responsible for managing plugin configuration fails to perform rigorous input validation or output encoding on user-supplied data before storing it in the database and subsequently injecting it into the Document Object Model (DOM) via bundled front-end scripts.\nThe root cause is a lack of server-side sanitization on settings fields that are rendered directly into JavaScript-generated markup. An attacker possessing administrative privileges can input a crafted payload containing malicious JavaScript tags or event handlers into the vulnerable settings field. Because the plugin does not properly sanitize this input, the payload is persisted as part of the plugin configuration.\nWhen a legitimate user or visitor navigates to the public-facing side of the website, the plugin's front-end scripts retrieve this stored configuration and inject it into the rendered HTML markup. The browser interprets the injected data as legitimate executable code, leading to the execution of the attacker's script within the security context (origin) of the WordPress site.\nThe attack flow is as follows: 1) An attacker authenticates to the WordPress administrative dashboard with sufficient privileges. 2) The attacker navigates to the GTranslate plugin settings page. 3) The attacker injects an arbitrary JavaScript payload into a vulnerable settings field. 4) The plugin saves the unsanitized payload to the database. 5) A visitor browses the front-end of the site. 6) The plugin includes the malicious script in the rendered page markup. 7) The visitor's browser executes the script, allowing the attacker to perform actions such as session hijacking, redirection to malicious domains, or unauthorized content modification via the victim's session.\nThis vulnerability is classified as Stored XSS because the payload is permanently stored on the server. The impact is significant because the execution occurs automatically whenever a user visits the affected pages, bypassing standard client-side security mechanisms by operating within the trusted origin of the site. The affected versions are strictly those prior to 3.0.10, necessitating an update to the latest patched version to enforce input validation routines."
}