Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. Attackers can retrieve a deterministically derived API key from the `gptApiKey` JavaScript variable in the HTML source of any page. This key allows the submission of malicious translation payloads to the '/wp-json/gptranslate/v1/request' endpoint, resulting in the execution of arbitrary web scripts when a user accesses an affected page.