GPTranslate güvenlik açıkları

Bilinen açık kayıtları

En yeniden eskiye. Her kaydın özgün metni NVD’de.

• CVE-2026-103309Yüksek · 7,58 Ekim 2026

  depolanmış siteler arası betik çalıştırma (XSS)

  Etkilenen sürümler: 2.34.14 öncesi · Oturum açmadan istismar edilebilir

  The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.

  Türkçe kayıt ve ne yapmalı
• CVE-2026-89278Orta · 5,318 Eylül 2026

  hassas bilgi ifşası

  Etkilenen sürümler: 2.34.6 ve öncesi · Oturum açmadan istismar edilebilir

  The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.

• CVE-2026-49776Kritik · 9,316 Haziran 2026

  SQL enjeksiyonu

  Etkilenen sürümler: 2.32.6 ve öncesi · Oturum açmadan istismar edilebilir

  Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

• CVE-2026-9109Yüksek · 7,213 Haziran 2026

  depolanmış siteler arası betik çalıştırma (XSS)

  Etkilenen sürümler: 2.31 ve öncesi · Oturum açmadan istismar edilebilir

  The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The deterministically derived API key (sha256 of the site URL) is printed in the HTML source of every page via the JavaScript variable gptApiKey, meaning any unauthenticated visitor can retrieve the key and submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint without any additional precondition.