CVE-2026-103309

The GPTranslate WordPress plugin (versions prior to 2.34.14 ) contains an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the plugin's failure to properly restrict who can store translations and its failure to escape those translations when displayed on translat...

CVE-2026-9109 GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...

CVE-2026-9109: Improper Neutralization of Input During Web Page Generation

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Fluenx DeepL API translation plugin = 2.1.4 versions...

CVE-2023-27446: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Fluenx DeepL API translation plugin = 2.1.4 versions...

PT-2023-30118

Name of the Vulnerable Software and Affected Versions Fluenx DeepL API translation plugin versions prior to 2.3.9.1 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a we...

CVE-2023-46620: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Fluenx DeepL API translation plugin = 2.3.9.1 versions...

WordPress DeepL Pro API translation Plugin <= 2.4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software DeepL Pro API translation Type Plugin Vulnerable versions = 2.4.1.1 Fixed in 2.4.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46620 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 93ab7131fcdf Credits thien...

CVE-2022-3691: Files or Directories Accessible to External Parties

The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information including the DeepL API key in files that are publicly accessible to an external, unauthenticated visitor...