WP Manifestindependent plugin directory
manifest / i18n / qtranslate-xt

qTranslate-XT WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+ #1 in Languages & Localization

qTranslate-XT (eXTended) - reviving qTranslate-X multilingual plugin for WordPress. A new community-driven plugin soon. Built-in modules for WooCommerce, ACF, slugs and others.

★ 603stars
39kcomposer installs
3.16.1latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/qtranslate/qtranslate-xt/archive/refs/heads/master.zip

On Packagist as qtranslate/qtranslate-xt:

composer require qtranslate/qtranslate-xt
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

qTranslate-XT (eXTended)

Developed by: new qTranslate community, from qTranslate-X by John Clause and qTranslate by Qian Qin
Contributors: herrvigg, johnclause, chineseleper, Vavooon, grafcom
Tags: multilingual, language, admin, tinymce, bilingual, widget, switcher, i18n, l10n, multilanguage, translation
Requires at least: 5.0
Tested up to: 6.8.3
Requires PHP: 7.4
Stable tag: N/A
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Adds user-friendly multilingual content support, stored in single post.

Description

The qTranslate-XT plugin is an eXTended version of qTranslate-X that we are reviving with a new community, since the original plugin is abandoned by its author. Our first goal is to maintain the essential features of this plugin with the last Wordpress and PHP updates. The migration to Gutenberg will be a critical milestone for the survival of this plugin. We are currently building a new organization to give qTranslate a new life. Let's try together, anyone is welcome to participate!

GitHub repository of the new repo: https://github.com/qtranslate/qtranslate-xt.git.

Installation

Since the -XT version is not officially available at Wordpress.org the initial installation must be done manually. You require the permissions to access the plugins folder of your Wordpress installation. Contact your system administrator if needed.

  1. Download the last release from GitHub in zip or tar.gz format (usually zip for Windows users). Alternatively, download the current master branch to test the last updates before a version release. Developers are encouraged to git clone the repo.
  2. Uncompress the archive in your plugins folder and rename it to qtranslate-xt.
  3. Deactivate plugin qTranslate-X, qTranslate, mqTranslate, qTranslate Plus, zTranslate or any other multilingual plugin, if you are running any.
  4. Activate qTranslate-XT through the 'Plugins' admin page in WordPress (/wp-admin/plugins.php).

If you didn't already have qTranslate-X, proceed with the initial setup of qTranslate-XT:

  1. Open Settings > Languages configuration page and add/delete/disable any languages you need.
  2. Add the "qTranslate Language Chooser" widget or "Language Switcher" menu item to let your visitors switch the language.

Check the FAQ for further instructions.

Frequently Asked Questions

Why is qTranslate-X not maintained anymore?

The previous qTranslate-Team was only one person. We tried to contact the author many times but we got no answer since 2016. Our goal is to build up a real team and make this plugin available again for the whole community. We can't update the official plugin yet. It is still not clear either if we should go on with the qTranslate name, but for now we should focus on new releases. The -XT version can be seen for the least as a "bridge" project.

I'm still using qTranslate-X, can I test qTranslate-XT?

Yes and it's very easy! Currently you can have both qTranslate-X and qTranslate-XT installed in the plugins folder for experimentations, but you should have at most one active at any time: BOTH -X AND -XT SHARE THE SAME OPTIONS! So if you change some options and switch between the plugins, the last changes will remain for the other. The plugin can actually re-adapt its configuration after a switch, in the general case you have nothing to do. If you have some incompatible options you should see some warnings. Note that even if you uninstall either -X or -XT, the options are not erased!

Disclaimer: be sure to backup your database regularly.

Is the Block Editor (Gutenberg) supported?

It is partially supported, with some limitations. Read carefully our Gutenberg FAQ before use.

Is WooCommerce, ACF, QTS (Slugs), ... supported?

WooCommerce, ACF, Slugs and other plugins are now supported as built-in modules. Developers able to test properly are much welcome! Please send PR for bug fixes. See the complete list of available modules in our repo.

Is any plugin/themes supported?

Some major plugins are now supported with the built-in modules. Some plugins are also supported with built-in i18n configurations. For other plugins you need to provide custom integration through i18n configuration (json) and/or code (PHP/JS). A major refactoring is needed to make this easier.

I'm new to qTranslate, where can I find detailed instructions for startup?

Check our Wiki pages:

How to update qTranslate-XT with the last release?

Since the -XT version is not available at wordpress.org, we recommend you to install GitHub Updater. This is is an awesome tool to update plugins from a git repo (with many other features). It checks regularly the last release available in github (from the git tags) and compares it to your current version (defined in the header of qtranslate.php). If a new release is available an update link will appear as for a regular plugin from Wordpress. The check is performed even if the plugin is deactivated.

Alternatively you can delete the current folder and repeat the installation from the last archive. Make sure to deactivate the previous version and then activate the new one, otherwise you will miss the execution of activation hooks and some options may become misconfigured.

Note for developers:

  • since GitHub Updater deploys the archive (tarball) your local git project will be removed if you installed it through git clone. If you want to use a cloned version in production you should not update through GHU, use git pull instead.
  • old releases may contain legacy headers that can become problematic. Be very cautious if you customize the updates for given branches!

Upgrade Notice

See Github releases.

Screenshots

See original plugin.

Changelog

See CHANGELOG.md for the full history.

Known Issues

The previous issues have been duplicated to our new git repository. Please check the git issues before creating new ones.

The legacy issues should also be reviewed before starting using the plugin.

Credentials

  • Thank you to all people motivated to make this plugin live again!
  • Thank you to the authors of the legacy versions, qTranslate-X by John Clause, qTranslate by Qian Qin and all the previous contributors.

Desirable Unimplemented Features

  • rename to a new official plugin (#601) and migrate with a separate configuration
  • refactor integration API, possibly without json files (i18n-config.json)
  • support for localized hreflang with country/region codes (ISO 3166-1 alpha-2)
  • full support for block editor (Gutenberg) with LSB (see #1097)
  • unit/integration tests, automated CI tests
  • utilities for DB maintenance (audit, cleanup)
  • legacy of desirable features.

Releases

Newest 25 of 60 recorded releases.

Tag
Published
3.16.1 latest
Oct 7, 2025 1 year ago
Oct 5, 2025 1 year ago
Sep 13, 2025 1 year ago
Aug 7, 2025 1 year ago
Mar 28, 2025 1 year ago
Jul 13, 2023 3 years ago
May 1, 2023 3 years ago
Apr 30, 2023 3 years ago
Apr 19, 2023 3 years ago
Apr 16, 2023 3 years ago
Apr 2, 2023 3 years ago
Dec 23, 2022 3 years ago
Sep 4, 2022 4 years ago
Jun 6, 2022 4 years ago
Dec 7, 2021 4 years ago
Dec 6, 2021 4 years ago
Dec 5, 2021 4 years ago
Nov 27, 2021 4 years ago
Aug 28, 2021 5 years ago
Jun 2, 2021 5 years ago
Apr 29, 2021 5 years ago
Mar 9, 2021 5 years ago
Jan 16, 2021 5 years ago
Nov 11, 2020 5 years ago
Sep 13, 2020 6 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

qTranslate-XT 3.16.1 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
3.16.1
Findings
3
Worst severity
high
Content hash
caaa43b54d4dea10bdfd764b…

Findings

  • high CSRF via GET language enable/disable/delete and irreversible database convert

    csrf

    qtranxf_verify_nonce() returns true whenever $_POST is empty, so check_admin_referer is never called for GET. qtranxf_edit_config() (manage_options, options-general.php?page=qtranslate-xt) then honors $_GET['enable'], disable, delete, moveup, movedown, convert, and markdefault. The admin UI emits those as nonce-less <a href> links (language list, Default Language / Order arrows, Import 'click here' convert/markdefault). A cross-site GET (link or form, which SameSite=Lax still attaches cookies to) lets an attacker disable/delete languages or run the irreversible post_title/post_content/post_excerpt UPDATEs. POST settings remain nonce-protected; only the GET actions are exposed. Capability is manage_options so a Subscriber cannot invoke this directly.

    src/admin/admin_options_update.php:11-15,144-303

    Recommendation

    Never treat empty POST as a valid nonce. Require wp_nonce_url / check_admin_referer for every state-changing GET (or convert those actions to POST). Reject convert/markdefault/delete/enable/disable/moveup/movedown unless the nonce matches qtranslate-x_configuration_form.

  • high Reflected XSS via unsanitized edit language-code query parameter

    xss_reflected

    On the Languages settings page, $_GET['edit'] is sanitize_text_field'd (quotes preserved) into $q_config['posted']['language_code'] and original_lang even when it fails QTX_LANG_CODE_FORMAT ([a-z]{2,3}). QTX_Admin_Settings::display() then renders the edit form whenever isset($_GET['edit']), echoing those values into HTML attributes with no esc_attr. Because GET skips qtranxf_verify_nonce, an administrator who opens a crafted URL such as options-general.php?page=qtranslate-xt&edit=" onfocus=alert(1) autofocus="x executes attacker script in wp-admin. This is the same page/handler as CVE-2015-9431's CSRF+XSS class on ancestor qTranslate-X; json_config_files is now sanitized, but the edit parameter was not. Observable: JS runs in the admin origin (session/token theft, create admin, install plugin).

    src/admin/admin_settings.php:77-79,128-132

    Recommendation

    Reject $_GET['edit'] unless it matches QTX_LANG_CODE_FORMAT (or a known stored language). Always echo language_code/original_lang with esc_attr(). Require a nonce even for the edit-form GET.

  • medium Admin+ stored XSS in language properties echoed on settings and frontend switcher

    xss_stored

    Language properties and several settings (language_name, locale, locale_html, date/time format, flag_location, ignore_file_types, custom_fields, custom_field_classes, text_field_filters, domains) are saved with sanitize_text_field only, which does not encode quotes. They are printed into admin input value/title/alt attributes without esc_attr (same sinks as WPScan 2a0917ac on qTranslate-X <= 3.4.6.8, still unpatched here). language_name is also concatenated into an inline frontend <script> in qtranxf_insertDropDownElement() as document.createTextNode('...'), so a payload such as English');alert(document.domain);// breaks the JS string for every visitor using the dropdown language chooser. locale_html is echoed into wp_head hreflang attributes. Write path is manage_options (single-site admins usually have unfiltered_html; this still matters on Multisite where unfiltered_html is disallowed). Consumer: admin settings HTML plus frontend widget/hreflang.

    src/utils.php:138-154

    Recommendation

    Escape all language and settings values on output (esc_attr in attributes, esc_js/json_encode when building the dropdown script, esc_url for flag/hreflang URLs). Prefer storing language_name through sanitize_text_field plus a strict charset, and never interpolate it into JavaScript string literals.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.