Translate WordPress with Weglot – Multilingual AI Translation Security & Risk Analysis

The Weglot plugin v5.4 presents a mixed security posture. While it demonstrates good practices in SQL query handling and output escaping, with 100% prepared statements and 88% properly escaped outputs, there are concerning areas. The presence of one unprotected AJAX handler represents a significant entry point that could be exploited without proper authentication. This is further highlighted by the taint analysis, which, despite a low volume of flows, reveals two instances of unsanitized paths. Although no critical or high severity taint flows were found, the fact that any unsanitized paths exist is a concern for potential XSS or path traversal vulnerabilities.

The plugin's vulnerability history, with two known medium severity CVEs related to Missing Authorization and Cross-site Scripting, is a significant indicator of past weaknesses. The absence of currently unpatched vulnerabilities is positive, but the recurring types of past vulnerabilities suggest a need for ongoing vigilance in code review and authorization checks. The most recent vulnerability being from late 2025, while a future date, suggests a historical pattern of medium-severity issues, not a current pressing concern for the provided version.

In conclusion, Weglot v5.4 has strengths in its data handling and output sanitization. However, the unprotected AJAX handler and past vulnerability patterns, particularly around authorization and XSS, warrant careful consideration. The plugin is not inherently insecure, but the identified entry point and historical context necessitate robust security monitoring and potentially further code hardening.