CVE-2026-17505
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.2.5. The translate_page() function unconditionally replaces internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML output after WordPress has already sanitized and escaped user input, allowing attackers to bypass WordPress's normal HTML escaping by using these tokens in the search query. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a specially crafted link.
Risk Assessment
An attacker can steal user data, hijack sessions, or perform other malicious actions in the victim's browser context. Requires user interaction but can be used in phishing campaigns.
Recommendation
Update the TranslatePress plugin to a patched version. Educate users about the risks of clicking suspicious links.
Other vulnerabilities in TranslatePress
See all- CVE-2026-66582High
Unauthenticated Cross Site Scripting (XSS) in TranslatePress versions up to and including 3.3.2.
- CVE-2026-19632Critical
The TranslatePress plugin for WordPress up to version 3.3.1 is vulnerable to Sensitive Information Exposure via the 'trp_get_translations_regular' AJAX action. Unauthenticated attackers can extract the raw administrator password-reset URL, enabling full administrator account takeover. Exploitation requires automatic string saving enabled (default) and the target administrator's profile locale set to a published secondary language.
- CVE-2026-78267Critical
Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.
- CVE-2026-76053High
The TranslatePress plugin for WordPress up to version 3.3.3 is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure.
- CVE-2026-18512Medium
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-75981High
The TranslatePress plugin for WordPress up to version 3.2.5 is vulnerable to unauthenticated Stored Cross-Site Scripting. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page(). An unauthenticated attacker can embed these markers in a comment, and when the post is viewed in a secondary language, the markers turn into a real <img> tag, allowing malicious script execution.
- CVE-2026-18510High
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.2.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input — allowing the attacker to bypass WordPress's normal HTML escaping by using these tokens, which are not HTML special characters, in the search query. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.