CVE-2026-9109: GPTranslate WordPress Plugin Stored XSS Vulnerability – Critical Patch Guidance

Technical summary

CVE-2026-9109 is a Stored Cross-Site Scripting (XSS) vulnerability in the GPTranslate WordPress plugin affecting versions up to 2.31. The flaw stems from insufficient input sanitization and output escaping in the REST API endpoint /wp-json/gptranslate/v1/request. The plugin derives its API key deterministically using SHA-256 of the site URL and exposes it as a JavaScript variable (gptApiKey) in the HTML source of every page. This allows unauthenticated attackers to bypass authentication requirements, submit arbitrary scripts via the REST API, and have those scripts persistently stored and executed whenever site visitors load affected pages. The CVSS 3.1 score of 7.2 (HIGH) reflects network-based exploitation with no privilege or user interaction requirements, though scope is changed and confidentiality and integrity impacts are considered limited in the scoring model.

Business impact

Organizations running WordPress sites with this plugin face significant reputational and operational risk. Attackers can inject malware, credential harvesters, or redirect visitors to malicious sites without site administrators needing to click anything. Visitor trust erodes rapidly once compromised. Financial exposure includes potential regulatory fines if customer data is harvested, incident response costs, and website downtime during remediation. Small to medium businesses relying on automatic translation features are particularly vulnerable since they may lack dedicated security monitoring.

Affected systems

The GPTranslate – Multilingual AI Translation for WordPress plugin in all versions up to and including 2.31 is affected. Any WordPress installation with this plugin active is vulnerable. No authentication is required to exploit the vulnerability, meaning even private or internal WordPress sites are at risk if accessible to any network-aware attacker. Severity is elevated for public-facing sites with significant traffic or user engagement.

Exploitability

This vulnerability has a low barrier to exploitation. An attacker needs only to discover a WordPress site running GPTranslate (often detectable via plugin fingerprinting), extract the API key visible in the page source, and submit a crafted JSON payload to the REST API endpoint. No authentication, credentials, or user interaction is required. The deterministic nature of the API key derivation (based on site URL alone) means attackers can pre-compute keys for known targets. The ease of weaponization, combined with the public nature of the vulnerability, means active exploitation is likely if patches are not deployed promptly.

Remediation

Update the GPTranslate plugin to a patched version released after June 17, 2026 (the modification date of this CVE entry). Verify the patch version in the official WordPress plugin repository or vendor advisory before deploying. As an interim measure, if patching is delayed, disable the plugin and use alternative translation solutions, or restrict REST API access to authenticated users via Web Application Firewall (WAF) rules targeting the /wp-json/gptranslate/v1/request endpoint. Consider implementing Content Security Policy (CSP) headers to limit the impact of any injected scripts.

Patch guidance

Check the WordPress Plugin Directory and the GPTranslate vendor advisory for version 2.32 or later that addresses this vulnerability. Apply the patch immediately in a staging environment first to verify compatibility with your site configuration. Since the vulnerability affects versions up to 2.31, any version released after the CVE publication date with explicit fix notes should be considered. Organizations should enable automatic plugin updates or establish a process to check for security updates within 24-48 hours of publication.

Detection guidance

Monitor logs for unusual POST/GET requests to /wp-json/gptranslate/v1/request with unexpected JSON payloads. Look for stored XSS indicators such as script tags, event handlers, or encoded payloads in translation database entries. Check the plugin's translation storage tables for entries containing HTML or JavaScript syntax. Security plugins like Wordfence or Sucuri can help detect malicious scripts injected into page content. For forensics, review access logs from June 13, 2026 onwards to identify potential exploitation windows.

Why prioritize this

This vulnerability warrants immediate patching due to the combination of unauthenticated access, stored XSS impact, and low exploitation complexity. It does not appear on the KEV catalog yet, but the public disclosure and deterministic API key exposure make it an attractive target. Organizations should treat this as a critical priority for WordPress deployments, particularly those handling sensitive user data or operating in regulated industries.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects a network-accessible vulnerability with no authentication or user interaction required. The

Frequently asked questions