CVE-2025-15695
Received Received - Intake

Stored Cross-Site Scripting in GTranslate WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2025-15695
EUVD
EUVD-2025-210888

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gtranslate gtranslate to 3.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Translate WordPress with GTranslate plugin before version 3.0.10 has a stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly validate one of its settings before using it to build front-end scripts. Attackers with administrative access can inject malicious JavaScript that executes in the browser sessions of any site visitor.

Detection Guidance

Check the installed version of the GTranslate WordPress plugin. If it is below 3.0.10, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Impact Analysis

If exploited, this vulnerability allows attackers to run arbitrary JavaScript in the browsers of all site visitors. This could lead to session hijacking, theft of cookies or sensitive data, defacement of the website, or redirection to malicious sites. Visitors may unknowingly have their accounts compromised or personal information exposed.

Compliance Impact

This vulnerability could lead to data breaches, exposing user data and violating privacy regulations like GDPR and HIPAA. Organizations may face fines, legal action, and reputational damage if user data is compromised due to this flaw. Compliance with data protection standards requires timely patching of such vulnerabilities.

Mitigation Strategies

Update the GTranslate plugin to version 3.0.10 or later immediately. Remove or disable the plugin if an update is not possible. Review admin accounts for unauthorized changes and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart