CVE-2026-75981
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The TranslatePress plugin for WordPress up to version 3.2.5 is vulnerable to unauthenticated Stored Cross-Site Scripting. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page(). An unauthenticated attacker can embed these markers in a comment, and when the post is viewed in a secondary language, the markers turn into a real <img> tag, allowing malicious script execution.
Risk Assessment
The risk includes arbitrary script execution in the user's browser, which can lead to session theft, account takeover, or malware distribution.
Recommendation
Update the TranslatePress plugin to the latest version that includes the fix. Additionally, consider restricting comment posting for unauthenticated users.
Other vulnerabilities in TranslatePress
See all- CVE-2026-66582High
Unauthenticated Cross Site Scripting (XSS) in TranslatePress versions up to and including 3.3.2.
- CVE-2026-19632Critical
The TranslatePress plugin for WordPress up to version 3.3.1 is vulnerable to Sensitive Information Exposure via the 'trp_get_translations_regular' AJAX action. Unauthenticated attackers can extract the raw administrator password-reset URL, enabling full administrator account takeover. Exploitation requires automatic string saving enabled (default) and the target administrator's profile locale set to a published secondary language.
- CVE-2026-78267Critical
Unauthenticated Privilege Escalation in TranslatePress versions up to 3.3.2.
- CVE-2026-103062High
The TranslatePress plugin up to version 3.3.6 contains a stored XSS vulnerability. An attacker can save a malicious script that executes on every page visit.
- CVE-2026-89412High
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to and including 3.3.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into the translation dictionary that execute in an administrator's session.
- CVE-2026-76053High
The TranslatePress plugin for WordPress up to version 3.3.3 is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure.
- CVE-2026-18512Medium
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-18510High
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.2.6 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
- CVE-2026-17505Medium
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.2.5. The translate_page() function unconditionally replaces internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML output after WordPress has already sanitized and escaped user input, allowing attackers to bypass WordPress's normal HTML escaping by using these tokens in the search query. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a specially crafted link.
Original NVD description (English source)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS