Is CVE-2026-86604 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86604?

CVE-2026-86604 has a CVSS v3 severity of MEDIUM (4.8).

Back

CVE-2026-86604

Description

The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.