CVE-2020-11930

The GTranslate plugin for WordPress versions before 2.8.52 contained an unauthenticated reflected cross-site scripting flaw that could be exploited through a malicious link, specifically when the hreflang tags feature was enabled with paid sub-domain or sub-directory options. The issue stemmed from the plugin's failure to properly escape the WordPress add_query_arg function before outputting its results to the page.

Based on public CVE data (MITRE/NVD).