¿Es seguro Gtranslate?

Qué hace este plugin

• Slug: gtranslate
• 900000+ instalaciones activas

languagemultilingualtranslatetranslationtranslator

Estado de mantenimiento

• Última versión conocida: 3.1.1
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

5 CVEs conocidos registrados para Gtranslate. Reportadas entre 2014 y 2023.

CVE-2023-4502

The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). This vulnerability affects multiple parameters.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Translate WordPress with GTranslate [gtranslate] < 3.0.4

No patched version available. Unknown discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress GTranslate Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has not been known to be fixed yet.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Translate WordPress with GTranslate [gtranslate] < 3.0.4

The GTranslate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fincl_langs', 'incl_langs' and 'alt_flags' parameters in versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0770

The Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 WordPress plugins do not have proper capabilities checks in the /wp-content/plugins/gtranslate/url_addon/gtranslate.php file which writes debug data such as user's cookies in a publicly accessible file when the enable_debug parameter is set to true. This would make it possible for an attacker to steal and administrators cookies if they can successfully trick them into accessing that file with the parameter set.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-25103

The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. Note: exploitation of the issue requires knowledge of the NONCE_SALT and NONCE_KEY

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-34630

In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER['REQUEST_URI']. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below, or in cases where an attacker is able to modify the request en route between the client and the server, or in cases where the user is using an atypical browsing solution.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-11930

The GTranslate plugin before 2.8.52 for WordPress was vulnerable to an Unauthenticated Reflected XSS vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option. The vulnerability was due to outputting the WordPress add_query_arg function without prior escaping.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Translate WordPress with GTranslate [gtranslate] < 2.8.11

The Google Translate Plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 2.8.10. This is due to the application failing to properly verify user-supplied input from the `gurl` parameter. This makes it possible for unauthenticated attackers to exploit this issue and redirect users to arbitrary web sites and conduct phishing attacks; other attacks are also possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 3 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Translate WordPress with GTranslate [gtranslate] < 1.0.13	—	Desconocido	< 1.0.13	1.0.13	2014-08-01	✓ corregido en la última versión
—	Translate WordPress with GTranslate [gtranslate] < 2.8.11	—	Desconocido	< 2.8.11	2.8.11	—	✓ corregido en la última versión
—	Translate WordPress with GTranslate [gtranslate] < 1.0.13	—	Desconocido	< 1.0.13	1.0.13	—	✓ corregido en la última versión

Translate WordPress with GTranslate [gtranslate] < 1.0.13

This plugin is prone to a cross site request forgery vulnerability. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Translate WordPress with GTranslate [gtranslate] < 2.8.11

The Translate WordPress with GTranslate WordPress plugin was affected by an Unauthenticated Open Redirect security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Translate WordPress with GTranslate [gtranslate] < 1.0.13

The Translate WordPress with GTranslate WordPress plugin was affected by a gtranslate.php Widget Code Editing CSRF security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Gtranslate actualizado — 3.1.1 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Loco Translate — 1000000+ instalaciones activas — 96/100 (450) — PHP máx. 8.4
• Polylang — 800000+ instalaciones activas — 94/100 (2962) — PHP máx. 8.4
• TranslatePress – Translate Multilingual sites with AI Translation — 400000+ instalaciones activas — 94/100 (1641) — PHP máx. 8.4
• Cyr-To-Lat — 300000+ instalaciones activas — 94/100 (98)
• Translate WordPress – Google Language Translator — 100000+ instalaciones activas — 94/100 (618) — PHP máx. 8.4