Translate WordPress – Google Language Translator
Translate WordPress – Google Language Translator has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2023; all 8 are fixed as of October 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2021 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (63%). Other recurring categories include Missing Authorization.
Every one of the 8 issues recorded for Translate WordPress – Google Language Translator has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, one record each. Translate WordPress – Google Language Translator is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2022-0770Translate WordPress with GTranslate <= 2.9.8 & Translate WordPress – Google Language Translator <= 6.0.13 - Missing Authorization to Sensitive Information Disclosure
Read the full analysisVulnerability Records

Translate WordPress – Google Language Translator
Author
edo888
Google Language Translator plugin is now a part of GTranslate family! GTranslate is a leading website translation services provider since 2008 and powers more than 1,000,000 multilingual websites worldwide. Please use Google Language Translator Support for your questions and support requests! We are multilingual! Please check our FAQ to get quick answers. Free translation service: permitted use Under the GTranslate Terms of Service, the free translation service is available for personal, educational, internal testing, nonprofit and governmental purposes, provided the use does not directly generate revenue from the service. Nonprofit use must further nonprofit activities; governmental use includes public institutions and other public-sector entities. Commercial or revenue-generating use requires an applicable paid subscription. This free-service restriction does not apply to free trials of paid subscriptions. These service conditions do not change the WordPress plugin code’s GPLv2-or-later license. Features Automatic machine translation Translate the site on the fly Translate posts and pages Translate categories and tags Translate menus and widgets Translate themes and plugins Right to left language support Floating language selector Language bar with flags in menu Translate WooCommerce shop Paid Features Multilingual SEO – Enable search engine indexing Neural machine translations with human level translation quality Increase traffic and AdSense revenue Search engine friendly (SEF) URLs Yoast SEO compatible WooCommerce compatible You can have sub-directory (example.com/es/) or sub-domain (es.example.com) URL structure Translate URLs aka slug translation is possible (example.com/about-us → example.es/sobre-nosotros) Add hreflang tags for translated alternatives You can manually correct translations In context translation interface (make corrections without losing the context) Translate meta data (meta keywords, meta description) Translating schema.org microdata for better search engine appearance Seamless updates (cloud service updated on our side – SaaS, you do not need to worry about backups on your side) Translate JSON objects (JSON format translation) Translate AMP pages (Accelerated Mobile Pages translation) Image localization – Translate media Translation Proxy (aka Translation Delivery Network) Centralized Translation Cache – We revise and improve translations over time Language Hosting (example.fr) User Dashboard with Analytics Live Chat Support External services This plugin uses external services to load the language selector and obtain automatic translations. GTranslate widget delivery When the widget loads, the visitor’s browser requests its files from cdn.gtranslate.net over HTTPS. GTranslate, Inc. provides the widget, which connects the visitor’s browser to the translation service. Google translation requests When page translation is requested, the widget sends page text for translation from the visitor’s browser to translate-pa.googleapis.com over HTTPS. Google processes these translation requests. The content sent is the page text being translated. Loading widget files and requesting translations are separate network operations. These requests also expose standard connection and HTTP request information, such as the visitor’s IP address and browser headers, to the receiving service. Provider processing and retention practices are described in the applicable policies; browser-based translation does not mean that no data leaves the browser or that providers retain no data. If you configure a paid translation proxy service, translated versions of your website are processed and served through GTranslate’s cloud infrastructure according to your service configuration. GTranslate, Inc.: Terms of Service, Privacy Policy Google: Terms of Service, Privacy Policy Review these services when updating your website’s privacy information and configuring any consent or content-security controls. The plugin requires access to the relevant external services for translation to work.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C