CVE-2026-89278 is a Sensitive Information Exposure vulnerability in the GPTranslate – Multilingual AI Translation Agent for WordPress plugin. This medium-severity vulnerability allows unauthenticated attackers to extract plaintext third-party AI provider API keys by fetching public pages and applying transformations from the plugin's JavaScript asset. The vulnerability affects all versions up to, and incl [truncated]
The GPTranslate – Multilingual AI Translation for WordPress plugin is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage. This vulnerability affects all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages, which will execute when a user accesses an injected page. The [truncated]
