CVE-2026-18510

Unauthenticated Cross Site Scripting (XSS) in TranslatePress versions up to and including 3.3.2.

The TranslatePress plugin for WordPress up to version 3.3.1 is vulnerable to Sensitive Information Exposure via the 'trp_get_translations_regular' AJAX action. Unauthenticated attackers can extract the raw administrator password-reset URL, enabling full administrator account takeover. Exploitation requires automatic string saving enabled (default) and the target administrator's profile locale set to a published secondary language.

Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.

The TranslatePress plugin for WordPress up to version 3.3.3 is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The TranslatePress plugin for WordPress up to version 3.2.5 is vulnerable to unauthenticated Stored Cross-Site Scripting. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page(). An unauthenticated attacker can embed these markers in a comment, and when the post is viewed in a secondary language, the markers turn into a real <img> tag, allowing malicious script execution.

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.2.5. The translate_page() function unconditionally replaces internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML output after WordPress has already sanitized and escaped user input, allowing attackers to bypass WordPress's normal HTML escaping by using these tokens in the search query. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a specially crafted link.