EUVD-2026-53178
GHSA-7j35-mf26-76vf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS; no attacker privileges required; victim must click crafted link; scope changes as injected script executes in victim browser context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Translate Multilingual sites - TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst
and #!trpen
marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input - allowing the attacker to bypass WordPress's normal HTML escaping by using these tokens, which are not HTML special characters, in the search query. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
AnalysisAI
Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal #!trpst#/#!trpen# token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the TranslatePress plugin installed and active in a version at or below 3.2.5 - no special non-default server configuration beyond plugin activation is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) accurately reflects the reflected XSS profile: fully network-accessible and requiring no attacker privileges, but gated on a single user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running TranslatePress ≤ 3.2.5 with a publicly accessible search page, then constructs a search URL embedding a JavaScript payload using `#!trpst#` and `#!trpen#` token sequences in the `s` parameter to smuggle angle brackets past WordPress's output escaping. The attacker delivers this URL to an authenticated WordPress administrator via a phishing email or poisoned link on a third-party site, and when the administrator clicks through, the injected script executes in their browser - enabling session cookie theft and full site takeover. … |
| Remediation | An upstream fix has been committed to the WordPress.org plugin SVN repository in changeset 3624567, modifying `class-translation-render.php` (compared against prior revision 3617108); however, no specific released version number beyond 3.2.5 is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Transla
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthent
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject pers
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated a
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today