We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

GPTranslate – Multilingual AI Translation for WordPress Plugin Vulnerability (CVE-2026-9109)

Nick Paliughi
On this page

Security Alert Summary

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin is vulnerable to stored Cross-Site Scripting (XSS) via its REST API translation storage in all versions up to and including 2.31. Insufficient input sanitization and output escaping combined with a deterministically derived API key exposed in page source enables unauthenticated attackers to submit and store malicious translation payloads that execute when a user views an injected page.

CVE Details

  • CVE ID: CVE-2026-9109
  • Affected component: GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress
  • Affected versions: All versions up to and including 2.31
  • Published: June 13, 2026 at 7:16:14 AM UTC
  • Last modified: June 13, 2026 at 7:16:14 AM UTC
  • CVSS v3.1: Base Score 7.2, Severity HIGH
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  • Authentication / Privileges / User Interaction: Unauthenticated (Privileges Required: NONE, User Interaction: NONE)
  • Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
  • CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation (Cross-site Scripting))

Technical Details

This vulnerability is a stored cross-site scripting issue introduced by insufficient input sanitization and missing output escaping in the plugin’s translation storage. The plugin prints a deterministically derived API key (the SHA-256 of the site URL) into every page source via the JavaScript variable gptApiKey. Because this value appears in HTML source, any unauthenticated visitor can retrieve the key and use it to interact with the plugin’s REST API.

The REST endpoint identified in the report is /wp-json/gptranslate/v1/request. An attacker who obtains the gptApiKey can submit translation requests containing malicious script payloads to that endpoint. Those payloads can be stored by the plugin and later rendered on pages viewed by other users, causing the injected scripts to execute in their browsers.

The root cause is a combination of predictable exposure of an API key in page source and lack of proper input validation and output encoding in the translation storage and rendering paths, allowing persistent script injection.

How This Could Impact Your Website

Consider a site with a site owner, internal content editors, and external contractors who contribute or review translated content. An unauthenticated visitor could retrieve the printed gptApiKey, send a malicious translation payload to the REST API, and have that payload stored and displayed on a page. When an editor or staff member views the affected page, the injected script could run in their browser context.

Practical consequences include exposure of information visible to users who view the page (for example, internal user email addresses listed on pages), and an increased risk of targeted phishing or social engineering against staff who see the injected content. The CVSS impacts indicate confidentiality and integrity concerns at a low level and no direct availability impact; this does not imply complete site takeover but does present a real risk to user data and trust.

professional review: If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege write access.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and logs for unusual behavior, including unexpected content changes and REST API requests.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Secure Copy Content Protection and Content Locking Plugin Vulnerability (CVE-2026-9269)
Next Post
LWS Optimize – All-in-One Speed Booster & Cache Tools Plugin (CVE-2026-12089)