EUVD-2026-63331
GHSA-x2x9-hx7f-h28x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-accessible, no privileges required, user interaction needed to trigger; scope changes into victim browser session; availability impact unsupported by XSS mechanics alone.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
AnalysisAI
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - CVSS PR:N confirms the injection point is accessible to unauthenticated attackers against the affected plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 High score is grounded in real-world-relevant metrics: the attack is network-reachable, requires no authentication, and has low complexity, meaning any internet-exposed WordPress site running TranslatePress 3.3.2 or earlier represents a reachable target. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running TranslatePress 3.3.2 or earlier and crafts a URL or request that injects a JavaScript payload through an accessible translation input or language parameter. The attacker then delivers the crafted link to an authenticated administrator or logged-in user - via phishing, a forum post, or a shared page - inducing the victim to load the affected URL in their browser. … |
| Remediation | Update TranslatePress to a version above 3.3.2 via the WordPress admin plugin dashboard or the WordPress.org plugin repository as the primary remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify any running TranslatePress 3.3.2 or earlier and disable the plugin immediately; document which sites are affected and assess functional impact. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Translatepress
View allThe Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. Rated hi
Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and inc
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. Rat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today