CVE-2026-9109: GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage

Synopsis

Stored cross-site scripting (XSS) in the GPTranslate WordPress plugin (versions up to and including 2.31) allows any unauthenticated attacker to inject malicious JavaScript into translated page content via the plugin's REST API endpoint. The API key used to authenticate translation requests is derived deterministically from the site URL (SHA-256 hash) and is exposed in every page's HTML source, meaning any visitor can retrieve it and submit poisoned payloads without any additional precondition. Successful exploitation causes injected scripts to execute in the browsers of any user who views an affected page, enabling session theft, credential harvesting, and unauthorized actions on behalf of the victim. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site's REST API over the network; the /wp-json/gptranslate/v1/request endpoint must be publicly or network-accessible.

• AuthenticationNot required

  No account or credentials are needed: the API key is derived from the public site URL and printed in every page's HTML source, making it retrievable by any visitor.

• Victim interactionNot required

  No victim interaction is required to trigger the injected payload; the script executes automatically whenever any user loads a page that contains the stored malicious translation.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: the API key derivation is deterministic and the injection endpoint imposes no additional environmental requirements or race conditions.

Blast Radius

• Injected JavaScript executes in victim browsers and can read session cookies and authentication tokens, allowing an attacker to hijack active WordPress sessions.
• An attacker can silently capture form input including passwords and payment details entered on any affected page.
• Injected scripts can perform authenticated actions on behalf of logged-in users, including publishing content, changing account settings, or escalating privileges if an administrator visits a poisoned page.
• The stored payload persists across all users who view the affected translated content, meaning a single injection attempt can affect a large number of visitors over time.