CVE-2026-9109Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The deterministically derived API key (sha256 of the site URL) is printed in the HTML source of every page via the JavaScript variable gptApiKey, meaning any unauthenticated visitor can retrieve the key and submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint without any additional precondition.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters137d
Disclosure
#CVE-2026-9109 - Stored #XSS in #GPTranslate #WordPress plugin. Unauthenticated attackers can inject scripts affecting all site visitors. #CVSS 7.2. No patch available – disable or isolate . #infosec #developers #hackers #devops #100daysofdevelopment More: https://www.valtersit.com/cve/CVE-2026-9109
Post summary
The post announces a stored XSS flaw in the GPTranslate WordPress plugin (CVE‑2026‑9109) that allows unauthenticated script injection affecting all site visitors, with a CVSS score of 7.2 and recommends disabling the plugin as no patch is available.
0000042
929 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-9109 The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST… https://www.cve.org/CVERecord?id=CVE-2026-9109
Post summary
A CVE for the GPTranslate WordPress plugin has been published, revealing a stored XSS vulnerability via its REST API.
00000173
57.6K followersView on X

Explore more

Back to dashboard