EUVD-2025-210888
GHSA-4gfq-34p6-73xj
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Admin-only write (PR:H), victim must visit page (UI:R); no availability impact and scope unchanged as script is bounded to site origin.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.
AnalysisAI
Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.
Technical ContextAI
The vulnerability resides in a WordPress plugin (cpe:2.3:a:unknown:translate_wordpress_with_gtranslate:*) that integrates Google Translate into WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored variant: an administrator-controlled plugin setting is persisted to the database and later incorporated directly into markup output by a bundled front-end JavaScript without sanitization or escaping. When a visitor loads any page where the translation widget renders, the unsanitized value is injected into the DOM and executed as script in the visitor's browser context. The CVSS vector (AV:N/AC:L/PR:H/UI:R/S:U) reflects that exploitation requires administrator credentials to write the payload and at least one victim visit to trigger it.
RemediationAI
Vendor-released patch: 3.0.10. Update the Translate WordPress with GTranslate plugin to version 3.0.10 or later via the WordPress admin dashboard or wp-cli (wp plugin update translate-wordpress-with-gtranslate). This resolves the missing input validation before the bundled script constructs markup. If an immediate update is not feasible, the compensating control is to restrict WordPress administrator access strictly - audit all admin-role accounts, revoke any unnecessary elevated access, and enforce strong credentials with MFA, since the vulnerability is only exploitable by an authenticated administrator. Deactivating the plugin entirely eliminates the attack surface but also removes translation functionality. There is no known server-side WAF rule that can reliably block stored XSS injected via admin settings panels without broader plugin or dashboard access controls.
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. Rated medium severity (CVSS 6.1)
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today