TranslatePress EUVD-2026-102792

Two concrete prerequisites, both stated in the description: (1) the target site must allow UNMODERATED comment submission on at least one post (note: WordPress holds first-time commenters for moderation by default, so this is typically a changed Discussion setting), and (2) the site must have a SECONDARY LANGUAGE configured in TranslatePress so the vulnerable translation-render path (class-translation-render.php) processes the comment. The injection point is the 'comment' parameter; exploitation is unauthenticated (PR:N). Limiting factors: if comments are moderated/held, if no secondary language is active, or if the site does not expose comments at all, the attack does not succeed; impact also depends on a victim subsequently viewing the injected translated page.

The signals are moderately but not alarmingly aligned. CVSS 3.1 is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, low-complexity, unauthenticated (PR:N confirmed), scope-changed stored XSS with low confidentiality and integrity impact. Exploitation status is 'no public exploit identified at time of analysis' - no POC, EPSS, or KEV data was supplied, so the real-world exploitation probability cannot be quantified from the input and is effectively unknown rather than low. This is NOT a drop-everything priority: although unauthenticated and persistent, the vulnerability is gated by two deployment conditions (unmoderated comments enabled on at least one post, plus a secondary language configured). The SSVC-style read is 'exploitation: none observed; automatable: partially (comment submission is scriptable, but the unmoderated-comment prerequisite is not universal); technical impact: partial' - consistent with the High-but-not-Critical CVSS. A notable nuance: the vendor frames both prerequisites as reflecting TranslatePress's primary use case, which supports AC:L, yet WordPress does NOT auto-approve comments from first-time commenters by default, so 'unmoderated comment submission' is in practice a non-default moderation setting - verify the target's comment policy before treating this as default-config exploitable. Treat as a prioritized patch for multilingual sites with open comments, not an emergency for all installs.

On a TranslatePress-enabled site with a secondary language and unmoderated comments, an unauthenticated attacker submits a comment containing a crafted script payload via the 'comment' parameter. Because the input is insufficiently sanitized and the output is not escaped during translation rendering, the payload is stored and executes in the browser of any visitor who later views the affected (translated) page, enabling session/cookie theft, forced redirects, or admin-context actions if an administrator views it. No public exploit code was identified in the provided data, so attacker tooling maturity is unknown.