CVE-2021-34630: Reflected XSS in GTranslate Pro and GTranslate Enterprise < 2.8.65
In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslaterequesturivar function runs at the top of all pages and echoes out the contents of $SERVER['REQUESTURI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-34630?
CVE-2021-34630 is classified as a high severity vulnerability due to potential information disclosure risks.
How do I fix CVE-2021-34630?
To fix CVE-2021-34630, update the GTranslate plugin to version 2.8.65 or later.
What versions are affected by CVE-2021-34630?
CVE-2021-34630 affects GTranslate versions prior to 2.8.65 in both Pro and Enterprise editions.
What does CVE-2021-34630 exploit?
CVE-2021-34630 exploits the gtranslate_request_uri_var function which improperly echoes $_SERVER['REQUEST_URI'].
Is my WordPress site at risk from CVE-2021-34630?
If you are using an affected version of the GTranslate plugin on your WordPress site, you are at risk from CVE-2021-34630.