CVE-2026-39732

The Transliterator plugin for WordPress is vulnerable to stored cross-site scripting via comment content using a predictable {rstr_keep} placeholder in versions up to and including 2.5.8. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The payload survives WordPress comment sanitization because the tags and attributes used are permitted by the core comment kses allow-list.