What is the CVSS score of CVE-2026-76053?

CVE-2026-76053 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Which versions of TranslatePress are affected by CVE-2026-76053?

TranslatePress WordPress plugin through version 3.3.3 contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to permanently inject arbitrary JavaScript into website…

How to fix or mitigate CVE-2026-76053?

Within 24 hours, audit all WordPress installations to identify TranslatePress deployments and immediately disable the plugin on all versions 3.3.3 and below. Within 7 days, inspect database records for suspicious comments containing JavaScript payloads, implement Web Application Firewall rules to block script injection patterns in form inputs, and restrict comment submission to authenticated users only. Within 30 days, evaluate alternative translation plugins with current security support and execute migration away from TranslatePress, followed by comprehensive content sanitization to remove any malicious payloads from stored pages.

TranslatePress CVE-2026-76053

EUVD-2026-67397 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-28 Wordfence

WordPress XSS Translatepress Translate Multilingual Sites With Ai Translation

7.2

CVSS 3.1 · NVD

Severity by source

Vendor (Wordfence) PRIMARY

HIGH

qualitative

NVD

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

PR:N confirmed by unauthenticated comment injection; UI:R reflects that payload execution requires a separate victim page visit, correcting the provided UI:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 05:18 vuln.today

CVE Published

Aug 28, 2026 - 02:26 cve.org

HIGH 7.2

DescriptionNVD

The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure - an anchor tag with href and title attributes alongside a code tag - causing the malicious comment to be stored verbatim in the database, where it is later processed by the vulnerable parser during page translation.

AnalysisAI

Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Submit crafted comment via public form

Delivery

WordPress KSES allowlist permits anchor+code payload

Exploit

Malicious comment stored verbatim in database

Install

Victim loads translated page

TranslatePress parser re-renders comment unescaped

Execute

Injected script executes in victim browser

Impact

Session tokens or credentials exfiltrated

Recon

Submit crafted comment via public form

Delivery

WordPress KSES allowlist permits anchor+code payload

Exploit

Malicious comment stored verbatim in database

Install

Victim loads translated page

TranslatePress parser re-renders comment unescaped

Execute

Injected script executes in victim browser

Impact

Session tokens or credentials exfiltrated

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the targeted WordPress site has the TranslatePress plugin installed and active in version 3.3.3 or earlier, and that the plugin's translation rendering is triggered on pages where user-submitted comments appear. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N reflects a high-severity stored XSS with scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated visitor submits a WordPress comment containing a crafted anchor tag with href and title attributes wrapping a code tag - a structure permitted by the WordPress KSES comment allowlist. The comment is stored verbatim in the database without sanitization. …
Remediation	Upgrade TranslatePress to version 3.3.4 or later immediately; the fix is confirmed via the WordPress Trac changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Ftranslatepress-multilingual/tags/3.3.3&new_path=%2Ftranslatepress-multilingual/tags/3.3.4. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all WordPress installations to identify TranslatePress deployments and immediately disable the plugin on all versions 3.3.3 and below. …

Threat intelligence, references, and detailed analysis are available after sign-in.