CVE-2025-15695 GTranslate CVE debrief

Who should care

Defenders responsible for WordPress installations, especially those with administrator access to plugin settings, should assess exposure and prioritize remediation. This includes security teams, vulnerability management teams, and operators responsible for maintaining WordPress installations.

Why it matters

CVE-2025-15695 allows administrators to store JavaScript that runs in visitor sessions, requiring defenders to verify and remediate the vulnerability.

• Stored JavaScript can run in visitor sessions, potentially leading to unauthorized actions.
• Administrators can store malicious JavaScript, increasing the risk of site compromise.
• Verification of plugin version and settings is necessary to prevent exploitation.

Technical summary

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site. This vulnerability allows administrators to store JavaScript that can run in visitor sessions, potentially leading to unauthorized actions. The vulnerability is related to the plugin's handling of user input and JavaScript execution.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their WordPress installations, especially if administrators have access to the plugin settings.

Recommended defensive actions

• Verify the version of the Translate WordPress with GTranslate WordPress plugin and update to 3.0.10 or later.
• Restrict access to plugin settings to prevent administrators from storing malicious JavaScript.
• Monitor for suspicious JavaScript activity on the site.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability allows administrators to store JavaScript that runs in the session of any visitor to the site. The NVD entry is currently Received. Evidence is limited to the CVE Program record and NVD detail page. Defenders should verify plugin version and settings to prevent exploitation and monitor for suspicious JavaScript activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.