CVE-2026-86604: Unknown Gtranslate

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.

Affected products

• Unknown Gtranslate: before 5.0.1 (fixed in 5.0.1)

Published 2026-09-23. Last modified 2026-09-23.