Medium severity4.8NVD Advisory· Published Sep 23, 2026

CVE-2026-86604

Description

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Gtranslatellm-fuzzy
Range: <5.0.1
Package: https://wordpress.org/plugins/gtranslate

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/07c6e3a2-e8fe-4b25-a5d8-b5ed812100af/nvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000