The Translator plugin allows a Cross‑Site Request Forgery that can write attacker supplied script into the plugin’s stored data, resulting in Stored Cross‑Site Scripting. When a victim visits the affected WordPress site, the malicious script executes in the victim’s browser, potentially leaking credentials, defacing the site, or enabling further attacks. The flaw is a classic CSRF weakness (CWE‑352) permitting unauthenticated or low‑privilege users to trick privileged users into performing the action.

All WordPress installations running the Translator plugin from any unknown initial release up to and including version 0.3, released by the vendor kornelly.

The impact rating of 7.1 on the CVSS scale shows high severity, while the EPSS score of less than 1% indicates that, at this time, the probability of exploitation is low. The vulnerability is not present in the CISA KEV list. Attackers would need to formulate a crafted request—such as a link or form submission—to a user with administrative privileges; hence exploitation requires user interaction but is feasible for social engineering or malicious sites.