WordPress Plugin Vulnerabilities

GTranslate < 3.0.10 - Admin+ Stored XSS

Description

The plugin does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.

Proof of Concept

Affects Plugins

Plugin icon
gtranslate
Fixed in 3.0.10

References

CVE
CVE-2025-15695

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/
Verified
Yes
WPVDB ID
423b6be0-e0f2-42c0-8b40-4015e4a0e670

Timeline

Publicly Published
2026-09-09 (about 2 days ago)
Added
2026-09-09 (about 1 day ago)
Last Updated
2026-09-09 (about 1 day ago)

Other

Published
Title
Published
2023-01-27
Title
Quick Restaurant Menu < 2.1.0 - Admin+ Stored XSS
Published
2024-10-31
Title
amazing neo icon font for elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-03-11
Title
DP ALTerminator - Missing ALT manager <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2022-04-21
Title
VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ Stored Cross-Site Scripting
Published
2025-06-19
Title
Automatically Hierarchic Categories in Menu < 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting