What is the CVSS score of CVE-2026-18510?

CVE-2026-18510 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of TranslatePress are affected by CVE-2026-18510?

TranslatePress WordPress plugin (versions 3.2.6 and earlier) contains a stored XSS vulnerability allowing unauthenticated attackers to inject persistent malicious scripts through website comments…

How to fix or mitigate CVE-2026-18510?

No public exploit has been identified at time of analysis; however, the vulnerability's severity warrants immediate action. Within 24 hours, identify all WordPress installations running TranslatePress version 3.2.6 or earlier and immediately deactivate the plugin while auditing stored comments for suspicious injection patterns. Within 7 days, update TranslatePress to version 3.3 or later (the vendor-released patch), re-enable the plugin, and verify functionality restoration. Within 30 days, conduct thorough historical audit of comments for XSS payloads, review web server logs for exploitation attempts, and implement Web Application Firewall rules to detect and block XSS patterns.

TranslatePress CVE-2026-18510

EUVD-2026-53715 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Wordfence

GHSA-fhvv-89cj-8528

WordPress XSS Translatepress Translate Multilingual Sites With Ai Translation

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network-delivered stored XSS (PR:N, AV:N, AC:L) with scope change into victim browser (S:C); confidentiality and integrity impacts are low and bounded to client-side execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 07:01 vuln.today

CVE Published

Aug 06, 2026 - 05:29 cve.org

HIGH 7.2

DescriptionCVE.org

The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified.

AnalysisAI

Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Submit unauthenticated comment with URL-encoded gettext XSS payload

Delivery

Payload passes wp_kses allowlist validation unmodified

Exploit

Comment stored in WordPress database

Install

Moderator approves comment (or moderation bypassed for known commenter)

Victim visits page containing injected comment

Execute

TranslatePress rendering engine outputs gettext-processed content without escaping

Impact

Victim browser executes attacker script

Recon

Submit unauthenticated comment with URL-encoded gettext XSS payload

Delivery

Payload passes wp_kses allowlist validation unmodified

Exploit

Comment stored in WordPress database

Install

Moderator approves comment (or moderation bypassed for known commenter)

Victim visits page containing injected comment

Execute

TranslatePress rendering engine outputs gettext-processed content without escaping

Impact

Victim browser executes attacker script

Vulnerability AssessmentAI

Exploitation	TranslatePress plugin must be installed and active on the WordPress site - the vulnerability does not exist if the plugin is deactivated. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.2 score and vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N accurately reflects the technical severity: unauthenticated, low-complexity network exploitation with a scope change into the victim's browser. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker posts a comment to any TranslatePress-enabled page, embedding a JavaScript payload inside URL-encoded gettext-style markers using only WordPress-allowlisted tags - for example, a crafted href attribute with percent-encoded script characters that wp_kses accepts as a valid URL. Once the comment is stored and displayed (immediately if moderation is disabled, or after moderator approval for new commenters), TranslatePress's rendering engine processes the gettext markers and outputs the unescaped payload into the page HTML, causing every subsequent visitor's browser to execute the attacker's script. …
Remediation	Update TranslatePress to version 3.3 or later immediately; the fix is confirmed by the WordPress plugin Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&new=3634273%40translatepress-multilingual%2Ftags%2F3.3&old=3624567%40translatepress-multilingual%2Ftags%2F3.2.6 and the corresponding class-translation-render.php change at https://plugins.trac.wordpress.org/changeset/3634273/translatepress-multilingual/trunk/includes/class-translation-render.php. … Detailed patch versions, workarounds, and compensating controls in full report.