CVE-2021-34630

The Pro and Enterprise versions of GTranslate before version 2.8.65 contain a reflected cross-site scripting vulnerability in the gtranslate_request_uri_var function, which outputs the value of $_SERVER['REQUEST_URI'] without proper sanitization at the beginning of page loads. Although the plugin applies addslashes and modern browsers typically URL-encode requests automatically, the vulnerability remains exploitable in older browsers like Internet Explorer 9 and earlier, or when an attacker intercepts and modifies requests in transit, or when users employ non-standard browsing applications.

Based on public CVE data (MITRE/NVD).