JExtensions Store vulnerabilities

Products

• GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites 1
• jchatsocial 1
• WPSpeed 1

Latest JExtensions Store CVEs

Newest publication first

1. CVE-2026-49776 WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability

   Published 2026-06-15

   Critical·CVSS 9.3 EPSS 0.29%

   Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

2. CVE-2025-47590 WordPress WPSpeed plugin <= 2.6.5 - Cross Site Request Forgery (CSRF) Vulnerability

   Published 2025-05-07

   Medium·CVSS 4.3 EPSS 0.17%

   Cross-Site Request Forgery (CSRF) vulnerability in JExtensions Store WPSpeed wpspeed allows Cross Site Request Forgery.This issue affects WPSpeed: from n/a through <= 2.6.5.

3. CVE-2014-3863 Cross-site scripting (XSS) vulnerability in the JChatSocial component before 2.3 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the filename parameter in a file upload....

   Published 2014-10-20

   Medium·CVSS 4.3 EPSS 1.9%

   Cross-site scripting (XSS) vulnerability in the JChatSocial component before 2.3 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the filename parameter in a file upload in an active JChat chat window.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.