CVE-2026-9109: Unauthenticated Stored XSS in GPTranslate (CVSS 7.2)

CVE-2026-9109 is a CVSS 7.2 Unauthenticated Stored XSS in GPTranslate. The API key is predictable, so any visitor can inject scripts via the REST API.