# CVE-2026-76053: TranslatePress Stored Cross-Site Scripting via comment injection

Source: https://junglewise.ai/threats/cve-2026-76053-translatepress-stored-cross-site-scripting-via-comment-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76053 · Severity: high · CVSS 7.2 · Published 2026-08-28

TranslatePress is a WordPress plugin that enables websites to be translated into multiple languages. Attackers can inject malicious code into website comments that will execute in the browsers of visitors viewing those pages, potentially compromising visitor accounts or stealing sensitive data. This vulnerability requires no special access and affects all installations using the plugin.

Technologies: [TranslatePress – Translate Multilingual sites with AI Translation](https://junglewise.ai/threats/technologies/translate-multilingual-sites-with-ai-translation). Vendors: [TranslatePress](https://junglewise.ai/threats/vendors/translatepress).

## Quick answers

**Is CVE-2026-76053 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76053 being exploited in the wild.

**How severe is CVE-2026-76053?** High severity, with a CVSS score of 7.2, published 28 August 2026.

**Which products and versions are affected?** TranslatePress – Translate Multilingual sites with AI Translation up to and including 3.3.3.

**Is there a fix for CVE-2026-76053?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-76053 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76053?** Check whether you run TranslatePress – Translate Multilingual sites with AI Translation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the TranslatePress plugin's comment processing and HTML parsing logic. The root cause is insufficient input sanitization and output escaping in the plugin's HTML parser (simple_html_dom.php), combined with WordPress's default comment KSES allowlist that permits anchor tags with href/title attributes and code tags. Attackers can craft malicious comments that bypass WordPress's comment sanitization filters; these payloads are stored verbatim in the database and later executed when the page is accessed and translated. The vulnerability is network-accessible and unauthenticated, requiring only the ability to post a comment. An attacker can achieve arbitrary JavaScript execution in the context of any user viewing the affected page, enabling session hijacking, credential theft, or defacement. Patches are available in versions after 3.3.3.

## Affected products

- TranslatePress TranslatePress – Translate Multilingual sites with AI Translation up to and including 3.3.3

## Timeline

- 2026-08-28: disclosed: Vulnerability disclosed and CVE-2026-76053 published

## References

- [https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/assets/lib/simplehtmldom/simple_html_dom.php](https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/assets/lib/simplehtmldom/simple_html_dom.php)
- [https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/assets/lib/simplehtmldom/simple_html_dom.php](https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/assets/lib/simplehtmldom/simple_html_dom.php)

## Related threats

- [TranslatePress Translate Multilingual stored cross-site scripting](https://junglewise.ai/threats/cve-2026-120537-the-translatepress-translate-multilingual-sites-with-ai)
- [TranslatePress stored cross-site scripting in comments](https://junglewise.ai/threats/cve-2026-119167-the-translatepress-translate-multilingual-sites-with-ai)
- [TranslatePress Stored XSS in Translation Memory Suggestion Panel](https://junglewise.ai/threats/cve-2026-89412-the-translatepress-translate-multilingual-sites-with-ai)
- [TranslatePress sensitive information exposure in AJAX handler](https://junglewise.ai/threats/cve-2026-19632-translatepress-sensitive-information-exposure-in-ajax-handler)