CVE-2023-4502

CVE-2023-4502: Translate WordPress with GTranslate < 3.0.4 - Admin+ Stored XSS

Vendor Unknown
Product Translate WordPress with GTranslate
Published September 25, 2023
Last update May 2, 2025

CVSS base score

What the vulnerability does

01Description

The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.

Key dates

02Disclosure timeline

September 25, 2023 CVE published
May 2, 2025 Record updated