CVE-2025-58880
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-05

Last updated on: 2026-04-23

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reubenthiessen Translate This gTranslate Shortcode translate-this-google-translate-web-element-shortcode allows Stored XSS.This issue affects Translate This gTranslate Shortcode: from n/a through <= 1.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-05
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2025-09-05
EPSS Evaluated
2026-06-14
NVD
CVE-2025-58880
EUVD
EUVD-2025-26899
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack translate_this_gtranslate_shortcode *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-site Scripting (XSS) issue in the WordPress Translate This gTranslate Shortcode Plugin versions up to 1.0. It allows attackers with Contributor-level privileges to inject malicious scripts into web pages generated by the plugin. These scripts can execute when visitors access the affected website, potentially causing redirects, displaying unwanted advertisements, or executing other harmful HTML payloads. [1]

Mitigation Strategies

Immediate mitigation steps include applying virtual patching (vPatching) offered by Patchstack, which auto-mitigates the vulnerability without requiring an official patch and without impacting performance. Additionally, users should consider seeking professional incident response or assistance from their hosting provider if their sites are compromised. Since no official fix or patched version is currently available, disabling or removing the vulnerable plugin until a patch is released may also be advisable. [1]

Impact Analysis

The vulnerability can impact you by allowing attackers to inject malicious scripts that execute in the browsers of your website visitors. This can lead to unwanted redirects, display of malicious advertisements, or other harmful actions that compromise user experience and security. Although the severity is considered low and exploitation requires Contributor-level access, compromised sites may suffer reputational damage and security risks. [1]

Detection Guidance

Detection of this vulnerability involves monitoring for injected malicious scripts in the web pages generated by the Translate This gTranslate Shortcode plugin. Since plugin-based malware scanners may be unreliable, it is recommended to perform manual inspection of the web page source code for suspicious scripts or payloads. Network monitoring tools can be used to detect unusual outbound requests or script injections. Specific commands are not provided in the available resources. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-58880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart