WP Manifestindependent plugin directory
manifest / i18n / deepl-translator

DeepL Translator WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

WordPress plugin for translating pages and taxonomy terms via DeepL API (Polylang)

★ 0stars
8release downloads
v2.1.6latest · 3mo ago

Install

Download deepl-translator.zip From the v2.1.6 release on GitHub, Jul 15, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/dmytrivdev/deepl-translator/releases/download/v2.1.6/deepl-translator.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

WordPress plugin that translates entire pages and taxonomy terms via the DeepL API, using Polylang for language management.

Features

  • Translates page title, excerpt, and all Gutenberg blocks in one click
  • Custom blocks — uses translate.json schema for precise field control
  • Repeater fields at any nesting depth
  • Rich text with HTML tags preserved (<mark>, <br>, <strong>)
  • Internal URLs resolved to target language via Polylang
  • Post object IDs swapped for translated equivalents
  • Synced patterns (core/block) — translated copies created automatically
  • Theme meta fields — auto-detected by theme text domain prefix
  • Taxonomy term translation — name, slug, and term meta
  • Works on new draft translations before first save

Requirements

Installation

  1. Go to Releases and download the latest deepl-translator.zip
  2. In WordPress admin: Plugins → Add New → Upload Plugin
  3. Upload the zip and activate
  4. Go to Settings → DeepL Translator and enter your DeepL API key

Configuration

Settings → DeepL Translator

Field Description
DeepL API Key Your DeepL API key
API Type Free or Pro
Block folders One folder per line, relative to wp-content/. Each should contain block subfolders with a translate.json file

Block folders example:

plugins/my-blocks/blocks
themes/my-theme/blocks

After adding or editing any translate.json files — click Clear block.json cache.

Adding translation support for a custom block

Create translate.json in the block folder alongside block.json:

{
  "name": "myplugin/my-block",
  "attributes": {
    "title":       { "translate": "rich" },
    "description": { "translate": "rich" },
    "buttonText":  { "translate": "string" },
    "buttonLink":  { "translate": "url" },
    "buttonLinkId":{ "translate": "postobject" },
    "buttonType":  { "translate": "ignore" },
    "imageId":     { "translate": "ignore" },
    "imageUrl":    { "translate": "ignore" }
  }
}

Then go to Settings → DeepL Translator → Clear block.json cache.

Translate values

Value Description
rich Rich text — HTML tags preserved
string Plain text
url Internal URL — resolved to target language
postobject Post ID — swapped for translated equivalent
repeater Array of objects — each item processed recursively
ignore Skip this field

Updating

Updates appear in the standard WordPress Admin → Updates screen when a new release is published on GitHub.

License

MIT

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.1.6 latest
Jul 15, 2026 3mo ago
deepl-translator.zip
5
Jun 24, 2026 4mo ago
deepl-translator.zip
3
Jun 24, 2026 4mo ago
deepl-translator.zip
0
C- grade

Security

DeepL Translator 2.1.6 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.1.6
Findings
1
Worst severity
high
Content hash
79aa2f45476de40d120d8782…

Findings

  • high Translation AJAX overwrites arbitrary posts without edit_post capability

    missing_capability

    dt_ajax_translate verifies a nonce and current_user_can('edit_posts') then reads post_id and original_id from $_POST. It never calls current_user_can('edit_post', $post_id). dt_save_post_content() writes post_content through $wpdb->update, skipping wp_update_post, KSES, and per-post caps. Any role with the primitive edit_posts capability (Author, Contributor, Editor) can therefore replace another author's (or an administrator's) post body, and dt_sync_patterns() may create published wp_block posts. Subscribers lack edit_posts and cannot reach this.

    deepl-translator.php:406-527

    Recommendation

    Require current_user_can('edit_post', $post_id) and current_user_can('edit_post', $original_id). Save through wp_update_post() (or otherwise honor map_meta_cap and content_save_pre) instead of raw $wpdb->update.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.