Executive brief
TranslatePress is a WordPress plugin that enables websites to support multiple languages with AI-powered translation capabilities. A flaw in the plugin's translation editor allows authenticated users (with subscriber-level access or higher) to inject malicious scripts that execute when other users view translated pages, potentially compromising website visitors' data or spreading malware through the affected site.
Technical details
The plugin is vulnerable to Stored Cross-Site Scripting (XSS) in the translation editor's strings dropdown, where approved comment bodies are rendered without adequate input sanitization or output escaping. An authenticated attacker with subscriber-level permissions or above can inject arbitrary JavaScript into the translation system, and this malicious payload persists in the database. When any user accesses a page containing the injected translation string, the script executes in their browser context, enabling session hijacking, data theft, or further malware distribution. The vulnerability affects all versions up to and including 3.2.6; patches beyond this version should be available.
Affected products
- TranslatePress Translate Multilingual sites with AI Translation up to and including 3.2.6
Timeline
- 2026-08-25: disclosed