CVE-2020-11930

MEDIUM NUCLEI

GTranslate < 2.8.52 - Reflected Cross-Site Scripting via Hreflang Tags

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-11930 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.

Nuclei Templates (1)

WordPress GTranslate <2.8.52 - Cross-Site Scripting
MEDIUMby dhiyaneshDK
Shodan: http.html:/wp-content/plugins/gtranslate
FOFA: body=/wp-content/plugins/gtranslate

References (4)

Core 4
Core References
Product, Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/gtranslate/#developers
Patch, Third Party Advisory x_refsource_misc
https://plugins.trac.wordpress.org/changeset/2245581/gtranslate
Patch, Third Party Advisory x_refsource_misc
https://plugins.trac.wordpress.org/changeset/2245591/gtranslate
Third Party Advisory x_refsource_misc
https://wpvulndb.com/vulnerabilities/10181

Scores

CVSS v3 6.1
EPSS 0.0446
EPSS Percentile 90.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
gtranslate/translate_wordpress_with_gtranslate < 2.8.52
Published Apr 20, 2020
Tracked Since Feb 18, 2026