CVE-2026-18512
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
XSS attacks can lead to session theft, admin account takeover, or malware distribution among users visiting infected pages.
Recommendation
Update the TranslatePress plugin to a version newer than 3.2.6 and audit pages for injected scripts.
Other vulnerabilities in TranslatePress
See all- CVE-2026-66582High
Unauthenticated Cross Site Scripting (XSS) in TranslatePress versions up to and including 3.3.2.
- CVE-2026-19632Critical
The TranslatePress plugin for WordPress up to version 3.3.1 is vulnerable to Sensitive Information Exposure via the 'trp_get_translations_regular' AJAX action. Unauthenticated attackers can extract the raw administrator password-reset URL, enabling full administrator account takeover. Exploitation requires automatic string saving enabled (default) and the target administrator's profile locale set to a published secondary language.
- CVE-2026-78267Critical
Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.
- CVE-2026-76053High
The TranslatePress plugin for WordPress up to version 3.3.3 is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure.
- CVE-2026-75981High
The TranslatePress plugin for WordPress up to version 3.2.5 is vulnerable to unauthenticated Stored Cross-Site Scripting. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page(). An unauthenticated attacker can embed these markers in a comment, and when the post is viewed in a secondary language, the markers turn into a real <img> tag, allowing malicious script execution.
- CVE-2026-18510High
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.2.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-17505Medium
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.2.5. The translate_page() function unconditionally replaces internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML output after WordPress has already sanitized and escaped user input, allowing attackers to bypass WordPress's normal HTML escaping by using these tokens in the search query. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a specially crafted link.
Original NVD description (English source)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.