GPTranslate CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review GPTranslate CVE published 2026-10-08

CVE-2026-103309

CVE-2026-103309 is a Stored Cross-Site Scripting (XSS) vulnerability in the GPTranslate WordPress plugin before version 2.34.14. The plugin does not properly restrict who can store translations and does not escape them when outputting in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.