WordPress Translation Plugin Stored XSS via REST API

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The deterministically derived API key (sha256 of the site URL) is printed in the HTML source of every page via the JavaScript variable gptApiKey, meaning any unauthenticated visitor can retrieve the key and submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint without any additional precondition.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The GPTranslate multilingual translation plugin for WordPress contains a stored cross-site scripting (CWE-79) vulnerability in its REST API translation storage mechanism. Attackers can inject malicious JavaScript payloads through the API without authentication, and these scripts persist in the database to execute whenever any user visits the affected pages. This vulnerability affects all versions up to 2.31 and poses a significant risk to WordPress administrators and site visitors, as attackers can steal session tokens, redirect users to malicious sites, deface content, or harvest sensitive information from site interactions.

Casky's 301 matched security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability by analyzing MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify indicators such as: suspicious REST API calls to translation endpoints with unescaped payload parameters, stored script tags in translation data fields, and execution of scripts from unexpected origins in page rendering. The platform would flag insufficient input sanitization patterns in API handlers and missing output encoding in frontend rendering, correlating these findings with known exploitation chains. Security teams would see detailed detection rules mapping to initial access techniques exploiting web applications and reconnaissance activities probing for vulnerable plugin installations and API endpoints.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-9109.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-9109

Casky has 301 skills that investigate the attack patterns behind CVE-2026-9109. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn