Unauthenticated Stored XSS in TranslatePress <= 3.2.6 (CVE-2026-18510)

Vulnerability Overview Vulnerability Name: TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE ID: CVE-2026-18510 CVSS Score: 7.2 (High) Publication Date: August 5, 2026 Last Update Date: August 6, 2026 Researcher: Pham Duc Anh Impact Scope Software Type: Plugin Software Name: TranslatePress – Translate Multilingual sites with AI Translation Affected Versions: <= 3.2.6 Fixed Versions: 3.3 Remediation Recommendation: Upgrade to version 3.3 or later. Vulnerability Description The TranslatePress – Translate Multilingual sites with AI Translation plugin contains a stored Cross-Site Scripting (XSS) vulnerability in versions 3.2.6 and earlier. Attackers can inject arbitrary JavaScript code via comment content, which will execute when users visit the infected page. Although comment moderation may delay the exploitation by the initial commenter, exploitation cannot be prevented because the payload uses only tags and attributes allowed by WordPress, and URL validation is bypassed via percent-encoding. Reference Links plugins.trac.wordpress.org Additional Information CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Recent Related Vulnerabilities 1. TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting - CVE ID: CVE-2026-17505 - CVSS Score: 6.1 - Researcher: momopon1415 - Date: August 4, 2026 2. TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection - CVE ID: CVE-2025-58592 - CVSS Score: 8.1 - Researcher: Phat RIO - Date: September 24, 2025 3. TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection - CVE ID: CVE-2025-30773 - CVSS Score: 7.2 - Researcher: Ananda Dhakal - Date: March 27, 2025 4. Translate Multilingual sites – TranslatePress <= 2.7.5 - Cross-Site Request Forgery - CVE ID: CVE-2024-34827 - CVSS Score: 4.3 - Researcher: Dhabaleshwar Das - Date: May 9, 2024 5. TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection - CVE ID: CVE-2022-3141 - CVSS Score: 7.2 - Researcher: Elias Hohl - Date: July 23, 2022 6. TranslatePress <= 2.0.8 - Authenticated Stored Cross-Site Scripting - CVE ID: CVE-2021-24610 - CVSS Score: 4.8 - Researcher: apapedulmu - Date: August 30, 2021 Summary The TranslatePress – Translate Multilingual sites with AI Translation plugin contains a stored Cross-Site Scripting (XSS) vulnerability in versions 3.2.6 and earlier. It is recommended to upgrade to version 3.3 or later to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Stored XSS in TranslatePress <= 3.2.6 (CVE-2026-18510)