Executive Summary

The GPTranslate – Multilingual AI Translation for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) through its REST API Translation Storage. This vulnerability exists in all versions up to and including 2.31 due to insufficient input sanitization and output escaping.

An unauthenticated attacker can inject malicious web scripts into pages, which will execute whenever a user accesses those pages. Additionally, the plugin exposes a deterministically derived API key (a sha256 hash of the site URL) in the HTML source code, allowing any visitor to retrieve it and submit malicious translation payloads to the plugin's REST API endpoint without any further authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary scripts in the context of your website for any user who visits an injected page. This can lead to theft of user credentials, session hijacking, defacement, or distribution of malware.

Since the API key is exposed and can be used without authentication, attackers can repeatedly submit malicious translation data, potentially compromising the integrity and security of your website content and user interactions.

Useful 0 Not Useful 0