Autoglot – Automatic WordPress Translation implements a reflected Cross‑Site Scripting vulnerability due to improper neutralization of user input during page generation. Attackers can inject malicious scripts that will execute in the context of a user’s browser when the affected plugin processes a specially crafted request. This flaw could be used for defacement, credential theft, or redirecting users to malicious sites, compromising the security of site visitors.

WordPress sites running any version of the Autoglot – Automatic WordPress Translation plugin up to and including version 2.4.7 are affected. Versions prior to the first release and versions newer than 2.4.7 are not impacted.

The CVSS score of 7.1 indicates a high impact potential. The EPSS probability is less than 1 %, suggesting that, while the vulnerability exists, known exploitation is rare. It is not listed in the CISA KEV catalog. The likely attack vector is reflected XSS, where an attacker crafts a URL with malicious payloads that the plugin injects into page content, requiring only that a user visit the crafted link or that the site itself is prone to displaying unsanitized input. If exploited, the attacker can compromise the integrity and confidentiality of affected site visitors’ sessions.