EUVD-2026-84280
GHSA-h8jc-c8c9-624r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote injection (PR:N, AV:N, AC:L); UI:R because payload fires only when an admin views the suggestion panel; S:C and C:L/I:L for script execution in the admin's session.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence, and the original column is deliberately exempt from kses filtering - meaning no save-time sanitizer neutralizes the stored payload before it is later rendered in an administrator's session.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the WordPress plugin TranslatePress - Translate Multilingual sites with AI Translation, affecting all versions up to and including 3.3.5, lets unauthenticated attackers plant executable HTML into the translation memory 'original' column through the front-end rendering pipeline, which runs html_entity_decode() on entity-encoded input before the value is persisted from a column that is deliberately exempt from WordPress kses filtering. The injected markup is later rebound into the DOM by the Vue-based Translation Memory Suggestion Panel component (v-html on suggestion.original) and executes in the browser of a privileged administrator who opens that panel, which is why the vendor applies a scope change (S:C) - an unauthenticated payload executes inside an authenticated admin session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the TranslatePress translation/rendering pipeline to be active (default for the plugin's core multilingual function) so that html_entity_decode() processes attacker-supplied front-end content before persistence into the translation memory 'original' column, which is intentionally exempt from kses sanitization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2 High) describes an unauthenticated, network-reachable, low-complexity stored XSS whose scope-change (S:C) reflects that an unauthenticated attacker's payload executes later inside a privileged administrator's browser session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the plugin to TranslatePress 3.3.6, the vendor-released fixed version, using the WordPress plugin updater or by downloading the 3.3.6 tag; the patch is documented in the Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&new=3697206%40translatepress-multilingual%2Ftags%2F3.3.6&old=3686891%40translatepress-multilingual%2Ftags%2F3.3.5 and the patch that corrects the Vue rendering is at https://plugins.trac.wordpress.org/changeset/3697206/translatepress-multilingual/trunk/assets/src/js/components/translation-memory.vue, with context in the Wordfence advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/717e8479-921b-4f18-8fbe-32e0d8a37590?source=cve. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress instance running TranslatePress at version 3.3.5 or lower, confirm whether multilingual sites are business-critical, and where the plugin is not essential, deactivate and remove it from production; where it must remain, restrict administrator logins to named accounts, force session invalidation for privileged users, and add a web application firewall or reverse-proxy rule that strips raw HTML tags from the translation memory submission and rendering endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today