CVE-2015-9431: Qtranslate X Project Qtranslate X

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.

Affected products

• Qtranslate X Project Qtranslate X: before 3.4.4 (fixed in 3.4.4)

Published 2019-09-26. Last modified 2026-06-17.