EUVD-2026-65317
GHSA-2x24-5vr7-4mrh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Subscriber authentication required (PR:L); stored payload auto-executes on page load (UI:N); script runs in admin browser context crossing security boundary (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) TranslatePress version 3.2.6 or earlier is installed and active on the target WordPress site; (2) the attacker holds a valid subscriber-level (or higher) WordPress account - subscriber is the minimum role; (3) the attacker can submit a comment that is subsequently approved by a site moderator, causing the comment body to appear as a string in the Translation Editor's Strings Dropdown; (4) a higher-privileged user (editor or administrator) must open the Translation Editor and access the Strings Dropdown after the malicious comment has been approved and indexed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N accurately reflects the mechanics but understates the operational impact: the S:C (Scope Change) metric is the critical signal, indicating the attacker's subscriber-level payload crosses a security boundary to execute in the context of higher-privileged users who interact with the translation editor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a subscriber account on the target WordPress site and submits a comment containing a crafted JavaScript payload such as a script tag or attribute-based event handler. Once a moderator approves the comment and it is indexed as a translation string, any administrator or editor who opens the Translation Editor's Strings Dropdown will have the attacker's script execute in their browser session, allowing the attacker to exfiltrate the admin's session cookie and take over the WordPress admin panel. … |
| Remediation | Upgrade TranslatePress to version 3.3 or later immediately; the fix is confirmed in the WordPress plugin repository changeset (plugins.trac.wordpress.org/changeset?reponame=&new=3634273%40translatepress-multilingual%2Ftags%2F3.3) which addresses the sanitization deficiencies in editor.vue and utils.js. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and e
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Transla
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthent
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject pers
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today