Translatepress Translate Multilingual Sites With Ai Translation
Monthly
Stored cross-site scripting in the TranslatePress - Translate Multilingual Sites with AI Translation WordPress plugin through version 3.3.7 allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which then execute in the browser of any visitor who loads the affected translated page. Successful exploitation depends on two conditions that coincide with the plugin's normal use case: the site must permit unmoderated comment submission on at least one post (WordPress holds first-time commenters for moderation by default, so this usually means a modified Discussion setting), and a secondary language must be configured so that comments are processed by the plugin's translation-render code path. Wordfence rates the issue at CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), confirming unauthenticated remote exploitation with no user interaction on the attacker's side and a scope change reflecting how stored script in a comment can act beyond the vulnerable component, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin TranslatePress - Translate Multilingual sites with AI Translation, affecting all versions up to and including 3.3.5, lets unauthenticated attackers plant executable HTML into the translation memory 'original' column through the front-end rendering pipeline, which runs html_entity_decode() on entity-encoded input before the value is persisted from a column that is deliberately exempt from WordPress kses filtering. The injected markup is later rebound into the DOM by the Vue-based Translation Memory Suggestion Panel component (v-html on suggestion.original) and executes in the browser of a privileged administrator who opens that panel, which is why the vendor applies a scope change (S:C) - an unauthenticated payload executes inside an authenticated admin session. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis; the vendor rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while independent assessment conservatively applies UI:R because administrator interaction with the suggestion panel is the required trigger. The vendor-released fix is TranslatePress 3.3.6.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. No confirmed active exploitation or public POC is identified at time of analysis; a vendor-released patch exists as version 3.3.
Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal `#!trpst#`/`#!trpen#` token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). No confirmed active exploitation (not in CISA KEV) and no public POC have been identified at time of analysis, though the unauthenticated, low-complexity path and large WordPress plugin install base make this a meaningful exposure for unpatched sites.
Stored cross-site scripting in the TranslatePress - Translate Multilingual Sites with AI Translation WordPress plugin through version 3.3.7 allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which then execute in the browser of any visitor who loads the affected translated page. Successful exploitation depends on two conditions that coincide with the plugin's normal use case: the site must permit unmoderated comment submission on at least one post (WordPress holds first-time commenters for moderation by default, so this usually means a modified Discussion setting), and a secondary language must be configured so that comments are processed by the plugin's translation-render code path. Wordfence rates the issue at CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), confirming unauthenticated remote exploitation with no user interaction on the attacker's side and a scope change reflecting how stored script in a comment can act beyond the vulnerable component, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WordPress plugin TranslatePress - Translate Multilingual sites with AI Translation, affecting all versions up to and including 3.3.5, lets unauthenticated attackers plant executable HTML into the translation memory 'original' column through the front-end rendering pipeline, which runs html_entity_decode() on entity-encoded input before the value is persisted from a column that is deliberately exempt from WordPress kses filtering. The injected markup is later rebound into the DOM by the Vue-based Translation Memory Suggestion Panel component (v-html on suggestion.original) and executes in the browser of a privileged administrator who opens that panel, which is why the vendor applies a scope change (S:C) - an unauthenticated payload executes inside an authenticated admin session. No public exploit code and no CISA KEV confirmed active exploitation were identified at time of analysis; the vendor rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while independent assessment conservatively applies UI:R because administrator interaction with the suggestion panel is the required trigger. The vendor-released fix is TranslatePress 3.3.6.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. Reported by Wordfence; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. No confirmed active exploitation or public POC is identified at time of analysis; a vendor-released patch exists as version 3.3.
Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal `#!trpst#`/`#!trpen#` token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). No confirmed active exploitation (not in CISA KEV) and no public POC have been identified at time of analysis, though the unauthenticated, low-complexity path and large WordPress plugin install base make this a meaningful exposure for unpatched sites.