CVE-2026-103309 GPTranslate CVE debrief

Who should care

Defenders responsible for WordPress installations with the GPTranslate plugin should assess exposure and consider upgrading to a patched version if available. They should verify if their GPTranslate plugin version is less than 2.34.14 and prioritize verifying if their GPTranslate plugin version is less than 2.34.14 and consider upgrading to a patched version if available. Defenders should also review compensating controls for exposed systems while

Why it matters

CVE-2026-103309 is a Stored Cross-Site Scripting vulnerability in the GPTranslate WordPress plugin. Defenders should assess exposure and consider upgrading to a patched version if available.

• Unauthenticated Stored Cross-Site Scripting attacks may be possible when server-side translations are enabled
• Defenders should verify if their GPTranslate plugin version is less than 2.34.14
• Upgrading to a patched version may be necessary to prevent exploitation

Technical summary

The GPTranslate WordPress plugin before version 2.34.14 does not properly restrict who can store translations and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled. This vulnerability can be exploited by unauthenticated users, and defenders should assess exposure and consider upgrading to a patched version if available. The plugin's failure to restrict translation storage and escape translations can lead to Stored Cross-Site Scripting attacks

Defensive priority

Defenders should prioritize verifying if their GPTranslate plugin version is less than 2.34.14 and consider upgrading to a patched version if available.

Recommended defensive actions

• Verify GPTranslate plugin version and consider upgrading to a patched version if available
• Restrict who can store translations in the GPTranslate plugin
• Escape translations when outputting them in translated pages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, but there is limited information on affected versions and no information on exploitation. The GPTranslate plugin before version 2.34.14 does not properly restrict who can store translations and does not escape them when outputting them in translated pages. Defenders should verify if their GPTranslate plugin version is less than 2.34.14 and consider upgrading to a patched version if available. Additional verification is needed to confirm affected scope and severity

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.