Executive brief
TranslatePress is a WordPress plugin that allows site owners to create multilingual versions of their websites with AI translation features. The plugin is vulnerable to stored cross-site scripting (XSS) in its translation memory suggestion panel, allowing unauthenticated attackers to inject malicious scripts that execute when administrators access the affected site. An attacker can exploit this to steal administrator credentials, modify site content, or perform unauthorized actions with site admin privileges.
Technical details
The vulnerability exists in the Translation Memory Suggestion Panel (v-html on suggestion.original) due to insufficient input sanitization and output escaping. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML through the front-end rendering pipeline, which decodes entity-encoded payloads via html_entity_decode() before persistence; since the original column is exempt from kses filtering, the payload is stored unsterilized and rendered in administrator sessions without sanitization.
Affected products
- TranslatePress TranslatePress – Translate Multilingual sites with AI Translation up to and including 3.3.5
Timeline
- 2026-09-22: disclosed