Cross-site Scripting Vulnerability in Translate This Plugin by WordPress
CVE-2025-58880

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Translate This Gtranslate Shortcode
Vendor
CVE Published:
5 September 2025

What is CVE-2025-58880?

The Translate This gTranslate Shortcode plugin for WordPress has a Cross-site Scripting (XSS) vulnerability stemming from improper input neutralization during web page generation. This flaw can result in stored XSS, allowing attackers to inject malicious scripts into web pages viewed by users. It impacts versions ranging from n/a through 1.0, posing a significant security risk for websites using this plugin. Proper mitigation strategies should be implemented to protect user data and maintain site integrity.

Affected Version(s)

Translate This gTranslate Shortcode <= 1.0

References

https://patchstack.com/database/wordpress/plugin/translat...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.
CVE-2025-58880 : Cross-site Scripting Vulnerability in Translate This Plugin by WordPress