Transliterator EUVD-2026-91914

Requires the Transliterator - Multilingual and Multi-script Text Conversion plugin (versions ≤2.5.8) installed and active on a WordPress site with public comments enabled and the plugin processing comment content. The attacker must craft a comment that combines WordPress core kses-permitted tags/attributes (specifically a[title] and code) with the literal characters of the plugin's shortcode markers and the predictable {rstr_keep} placeholder token, so the payload passes comment save-time sanitization and is later expanded into executable script. No authentication is required (PR:N). Limiting factors: the plugin must be active and transliterating comment output, comments must be open, and the injected script only fires when a user actually views the affected page (making administrators and visitors the effective targets); sites with comments disabled or the plugin inactive are not exploitable.

This is a stored XSS (CWE-79) in a WordPress transliteration plugin, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The AV:N/PR:N/UI:N combination is the genuinely concerning part: the input data (CVSS vector contains PR:N) indicates unauthenticated exploitation, and the description confirms attackers can inject via the public comment channel, which keeps the barrier to entry very low. The S:C (scope change) and C:L/I:L reflect that injected script executes in the browsers of other visitors/administrators viewing the affected page rather than compromising the server directly - impact is limited (L/L), not full compromise, which is why this lands at High rather than Critical. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the practical risk is therefore 'plausible and easy to weaponize but not confirmed in-the-wild.' A notable nuance to verify: the described attack survives comment kses sanitization specifically because it abuses core-permitted tags (a[title], code) combined with the plugin's own shortcode/placeholder tokens - so exploitability depends on the plugin being active and processing comment content, meaning real-world risk is narrower than the raw AV:N/PR:N vector alone suggests. Treat as a prioritize-for-patching issue on any site running this plugin with comments enabled, but not an emergency absent exploitation signals.

An unauthenticated attacker submits a blog comment containing kses-allowed markup (such as an a[title] or code tag) interleaved with the plugin's predictable {rstr_keep} placeholder and shortcode marker characters. WordPress's comment save-time sanitization preserves these literal characters, and when the Transliterator plugin later renders the comment the placeholder is resolved into executable HTML, so the injected script runs in the browser of every visitor or administrator who views the page. No public exploit code is identified in the supplied data, but the technique is fully described and requires no authentication.