CVE-2015-5535: Cross-site scripting (XSS) vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows r...

Security readout for executives and security teams

CVE-2015-5535 is a cross-site scripting issue in the WordPress qTranslate plugin version 2.5.39 and earlier. If a site uses an affected plugin version, an attacker may be able to inject script or HTML through the plugin’s admin settings page parameter. Sources do not show active exploitation or a named fixed version. Exposure is likely limited to WordPress sites with qTranslate 2.5.39 or earlier installed. The vulnerable endpoint is in wp-admin, so practical risk depends on plugin activation, admin access controls, and whether an attacker can induce a privileged user interaction. Prioritize this for WordPress properties that still rely on qTranslate, especially public or business-critical sites. The business risk is account/session compromise through administrator-targeted script injection, but urgency is moderated by incomplete severity data and no cited active exploitation evidence. Mitigation focus: Inventory WordPress sites for qTranslate and record installed versions.; Check vendor or trusted vulnerability database guidance for fixed, forked, or replacement options.; Disable or remove qTranslate where it is not business-critical..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.