CVE-2025-15695: Unknown Translate WordPress With Gtranslate

Low severity, CVSS 3.5. EPSS: 0.1% chance of exploitation in the next 30 days.

The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store JavaScript that runs in the session of any visitor to the site.

Affected products

• Unknown Translate WordPress With Gtranslate: before 3.0.10 (fixed in 3.0.10)

Published 2026-09-11. Last modified 2026-09-11.