¿Es seguro Google Language Translator?

Qué hace este plugin

• Slug: google-language-translator
• 100000+ instalaciones activas

languagetranslatetranslate wordpresstranslationtranslator

Estado de mantenimiento

• Última versión conocida: 6.0.20
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

5 CVEs conocidos registrados para Google Language Translator. Reportadas entre 2015 y 2024.

CVE-2021-4452

The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Specifically affects users with older browsers that lack proper URL encoding support.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-50375

Update the WordPress Google Language Translator plugin to the latest available version (at least 6.0.20). Abdi Pranata discovered and reported this Broken Access Control vulnerability in WordPress Google Language Translator Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 6.0.20. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Translate WordPress – Google Language Translator [google-language-translator] < 6.0.20

The Translate WordPress – Google Language Translator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_notice_ignore() function in all versions up to 6.0.20 (exclusive). This makes it possible for unauthenticated attackers to dismiss admin notices.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0770

The Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 WordPress plugins do not have proper capabilities checks in the /wp-content/plugins/gtranslate/url_addon/gtranslate.php file which writes debug data such as user's cookies in a publicly accessible file when the enable_debug parameter is set to true. This would make it possible for an attacker to steal and administrators cookies if they can successfully trick them into accessing that file with the parameter set.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-24594

The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Translate WordPress – Google Language Translator [google-language-translator] < 6.0.10

The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Specifically affects users with older browsers that lack proper URL encoding support.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Translate WordPress – Google Language Translator [google-language-translator] < 6.0.10

The Google Language Translator plugin for WordPress is vulnerable to Cross-Site Scripting via the glt shortcode in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers at the Author level to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2016-10870

The Translate WordPress – Google Language Translator WordPress plugin was affected by a XSS security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

+ 5 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Translate WordPress – Google Language Translator [google-language-translator] < 5.0.0	—	Desconocido	< 5.0.0	5.0.0	2015-08-13	✓ corregido en la última versión
—	Translate WordPress – Google Language Translator [google-language-translator] < 5.0.0	—	Desconocido	< 5.0.0	5.0.0	2015-08-13	✓ corregido en la última versión
—	Translate WordPress – Google Language Translator [google-language-translator] < 6.0.10	—	Desconocido	< 6.0.10	6.0.10	—	✓ corregido en la última versión
—	Translate WordPress – Google Language Translator [google-language-translator] < 6.0.10	—	Desconocido	< 6.0.10	6.0.10	—	✓ corregido en la última versión
—	Translate WordPress – Google Language Translator [google-language-translator] < 5.0.0	—	Desconocido	< 5.0.0	5.0.0	—	✓ corregido en la última versión

Translate WordPress – Google Language Translator [google-language-translator] < 5.0.0

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Vulnerable parameter is "googlelanguagetranslator_flags_order". Upgrade this plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Translate WordPress – Google Language Translator [google-language-translator] < 5.0.0

The Google Language Translator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.9 via 'the googlelanguagetranslator_flags_order' parameter due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Translate WordPress – Google Language Translator [google-language-translator] < 6.0.10

The plugin was vulnerable to Authenticated Cross-Site Scripting (XSS) allowing a user with Author role to execute malicious JavaScript via the glt shortcode.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Translate WordPress – Google Language Translator [google-language-translator] < 6.0.10

The plugin was vulnerable to Authenticated Cross-Site Scripting (XSS) only affecting older web browsers such as Internet Explorer <= 9.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Translate WordPress – Google Language Translator [google-language-translator] < 5.0.0

The Translate WordPress – Google Language Translator WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Google Language Translator actualizado — 6.0.20 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Loco Translate — 1000000+ instalaciones activas — 96/100 (450) — PHP máx. 8.4
• Translate WordPress with GTranslate — 900000+ instalaciones activas — 98/100 (4926) — PHP máx. 8.4
• Polylang — 800000+ instalaciones activas — 94/100 (2962) — PHP máx. 8.4
• TranslatePress – Translate Multilingual sites with AI Translation — 400000+ instalaciones activas — 94/100 (1641) — PHP máx. 8.4
• LocoAI – Auto Translate for Loco Translate — 70000+ instalaciones activas — 98/100 (635) — PHP máx. 8.4