TranslatePress CVE-2026-18510

TranslatePress plugin must be installed and active on the WordPress site - the vulnerability does not exist if the plugin is deactivated. The WordPress comment system must be open to public submissions (WordPress default). The critical bypass condition is specific to TranslatePress's gettext marker rendering in class-translation-render.php: the plugin processes comment content through its translation pipeline, which fails to escape output for percent-encoded characters that pass wp_kses validation. For first-time commenters, WordPress comment moderation delays exploitation until a site moderator approves the comment; however, this is not a security boundary - moderators reviewing the comment in the WordPress admin panel may not recognize the encoded payload. Sites that disable moderation entirely or that have previously-approved commenters are exploitable without any delay. No authentication, plugin configuration changes, or non-default WordPress settings are required beyond the plugin being active and comment submission being enabled.

The CVSS 7.2 score and vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N accurately reflects the technical severity: unauthenticated, low-complexity network exploitation with a scope change into the victim's browser. Real-world risk is meaningful but modulated by two factors. First, comment moderation for first-time commenters introduces a time delay - exploitation requires an administrator to approve the malicious comment, which narrows the no-interaction window. Repeat commenters (who bypass moderation by default) eliminate even this delay. Second, the impact per victim is bounded by client-side XSS: session hijacking, credential phishing, or further payload delivery are realistic outcomes, but server-side compromise requires chaining additional vulnerabilities. EPSS data was not provided, so exploitation probability cannot be quantified precisely. No CISA KEV listing and no confirmed POC indicate this is not currently mass-exploited. The percent-encoding bypass technique elevates this above trivial stored XSS and may evade WAF rules relying on keyword-pattern matching.

An unauthenticated attacker posts a comment to any TranslatePress-enabled page, embedding a JavaScript payload inside URL-encoded gettext-style markers using only WordPress-allowlisted tags - for example, a crafted href attribute with percent-encoded script characters that wp_kses accepts as a valid URL. Once the comment is stored and displayed (immediately if moderation is disabled, or after moderator approval for new commenters), TranslatePress's rendering engine processes the gettext markers and outputs the unescaped payload into the page HTML, causing every subsequent visitor's browser to execute the attacker's script. No public POC has been identified at time of analysis, but the bypass technique is described with sufficient specificity in the CVE to enable independent reproduction.