TranslatePress CVE-2026-17505

The target WordPress site must have the TranslatePress plugin installed and active in a version at or below 3.2.5 - no special non-default server configuration beyond plugin activation is required. The site must expose a publicly accessible search results page, which is standard WordPress behavior enabled by default. No attacker-side authentication is required (confirmed PR:N per CVSS vector). The critical limiting factor is mandatory user interaction: the victim must actively click a specially crafted search URL (UI:R per CVSS), requiring social engineering. Attack impact is scoped to individual victims who follow the malicious link rather than all site visitors, since this is reflected (not stored) XSS. Sites with a WAF rule specifically targeting the #!trpst#/#!trpen# token strings in URL parameters would effectively block this particular bypass vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) accurately reflects the reflected XSS profile: fully network-accessible and requiring no attacker privileges, but gated on a single user interaction. The Scope:Changed metric confirms injected scripts execute in the victim's browser security context, enabling session hijacking or credential theft. No EPSS score was provided in the source data, so exploitation probability cannot be quantified against the broader CVE population. This CVE does not appear in the CISA KEV catalog and no public POC was referenced, so no confirmed active exploitation is known at this time. Real-world risk is moderated by the social engineering requirement (UI:R) but amplified by TranslatePress's large reported install base among WordPress sites. A notable concern is that the bypass mechanism - exploiting a plugin's own post-processing token substitution - may evade generic WAF XSS rules that look for angle brackets or <script> tags directly in URL parameters, since the malicious payload uses only the innocuous token strings #!trpst# and #!trpen#, potentially increasing realistic exploitability beyond what the moderate CVSS score alone implies.

An attacker identifies a WordPress site running TranslatePress ≤ 3.2.5 with a publicly accessible search page, then constructs a search URL embedding a JavaScript payload using #!trpst# and #!trpen# token sequences in the s parameter to smuggle angle brackets past WordPress's output escaping. The attacker delivers this URL to an authenticated WordPress administrator via a phishing email or poisoned link on a third-party site, and when the administrator clicks through, the injected script executes in their browser - enabling session cookie theft and full site takeover. No confirmed public POC exists in the available data, but the technique is mechanically straightforward for an attacker familiar with the TranslatePress rendering pipeline.