CVE-2021-25103: GTranslate < 2.9.7 - Reflected Cross-Site Scripting

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-07 · updated 2026-06-17
Weakness: CWE-79

Description

The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCE_SALT and NONCE_KEY

Affected products

Translate WordPress with GTranslate: before 2.9.7 — fixed in 2.9.7

How to fix

Upgrade to a fixed version: Translate WordPress with GTranslate 2.9.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/90067336-c039-4cbe-aa9f-5eab5d1e1c3d
https://wpscan.com/vulnerability/90067336-c039-4cbe-aa9f-5eab5d1e1c3d

Get alerted when CVE-2021-25103 or the next vulnerability affects your stack