TranslatePress EUVD-2026-63331

No authentication is required - CVSS PR:N confirms the injection point is accessible to unauthenticated attackers against the affected plugin. Victim user interaction is required (UI:R): a user, preferably one with an active authenticated WordPress session, must be induced to visit or load the page or URL carrying the malicious payload. The target site must be running TranslatePress plugin version 3.3.2 or earlier. The specific vulnerable parameter or endpoint within the plugin is not named in the available data beyond the Patchstack reference; no non-default plugin configuration is identified as a prerequisite. Exploitation is constrained by the need to deliver the payload to a victim who will interact with it - drive-by exploitation of site visitors without session privileges yields reduced impact, while targeting administrators maximizes potential damage.

The CVSS 7.1 High score is grounded in real-world-relevant metrics: the attack is network-reachable, requires no authentication, and has low complexity, meaning any internet-exposed WordPress site running TranslatePress 3.3.2 or earlier represents a reachable target. The scope change is a meaningful escalation - successful exploitation places attacker-controlled code inside a victim's authenticated browser session, not merely on an unauthenticated page. No EPSS score was provided in the available data, so numerical exploitation probability cannot be quantified; this is an explicit gap in the available intelligence. The CVE does not appear in CISA KEV, and no public exploit code has been identified, which moderates immediate urgency; however, unauthenticated XSS in popular WordPress plugins is a historically fast-exploited class once a PoC circulates, particularly against sites accessible from the internet. No conflicts between data sources were identified, though the absence of EPSS data and the lack of a confirmed vendor advisory limit the depth of this assessment.

An unauthenticated attacker identifies a WordPress site running TranslatePress 3.3.2 or earlier and crafts a URL or request that injects a JavaScript payload through an accessible translation input or language parameter. The attacker then delivers the crafted link to an authenticated administrator or logged-in user - via phishing, a forum post, or a shared page - inducing the victim to load the affected URL in their browser. The injected script executes within the victim's authenticated WordPress session context, allowing the attacker to exfiltrate the session cookie, perform administrative actions, or redirect the victim to a credential-harvesting page.