Read the docs
TI-2021-13644 Aliases CVE-2021-34630GHSA-8946-7xgw-wqmj

Reflected XSS in GTranslate Pro and GTranslate Enterprise < 2.8.65

Priority LOW 30CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.

Why it matters now

EPSS 0.01565 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed GTranslate Pro and GTranslate Enterprise (Translate AI Multilingual Solutions): 2.8.65

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Translate AI Multilingual SolutionsGTranslate Pro and GTranslate Enterprise2.8.65 to before 2.8.652.8.65Patch availableCNA
  • GTranslate Pro and GTranslate Enterprise VendorTranslate AI Multilingual Solutions Affected 2.8.65 to before 2.8.65 Fixed in 2.8.65 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:gtranslate:gtranslate:*:*:*:*:enterprise:wordpress:*:*before 2.8.65VulnerableGtranslate
cpe:2.3:a:gtranslate:gtranslate:*:*:*:*:pro:wordpress:*:*before 2.8.65VulnerableGtranslate
  • cpe:2.3:a:gtranslate:gtranslate:*:*:*:*:enterprise:wordpress:*:* Versions before 2.8.65 Vulnerable ·Gtranslate
  • cpe:2.3:a:gtranslate:gtranslate:*:*:*:*:pro:wordpress:*:* Versions before 2.8.65 Vulnerable ·Gtranslate

Remediation

  • Fix · CNA GTranslate Pro and GTranslate Enterprise (Translate AI Multilingual Solutions) Fixed in 2.8.65

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34630
  2. 2026-10-03 Alias added: GHSA-8946-7xgw-wqmj

References

Exploit 1

  • TI-2026-07456 Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035 CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences