TranslatePress <= 3.2.5 Unauthenticated Stored XSS Advisory (CVE-2026-75981)

Vulnerability Overview Vulnerability Name: TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting CVE ID: CVE-2026-75981 CVSS Score: 7.2 (High) Publication Date: August 18, 2026 Last Updated: August 19, 2026 Researcher: Pham Duc Anh Affected Versions Affected Versions: TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 Vulnerability Type: Unauthenticated Stored Cross-Site Scripting (Stored XSS) Vulnerability Description: The TranslatePress plugin versions 3.2.5 and earlier contain an unauthenticated stored cross-site scripting vulnerability. The special gettext markers and are unconditionally rewritten to and within the function. Since these markers are plain text without HTML special characters, unauthenticated attackers can embed them in comments. When a post is viewed in a secondary language, the replacement converts the attacker’s and into genuine tags. Because the function only strips and tags, payloads will execute in the visitor's browser. Remediation Fixed Version: 3.2.6 Remediation Advice: Upgrade to version 3.2.6 or later patched versions Related Vulnerabilities CVE-2026-18510: TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-17505: TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting CVE-2025-58592: TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection CVE-2025-30773: TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection CVE-2024-34827: Translate Multilingual sites - TranslatePress <= 2.7.5 - Cross-Site Request Forgery CVE-2022-3141: TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection CVE-2021-24610: TranslatePress <= 2.0.8 - Authenticated Stored Cross-Site Scripting References plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Software Type: Plugin Software Slug: translatepress-multilingual Patched: Yes Patch Version: 3.2.6 Disclaimer This record contains copyrighted material. Copyright Information: 2012-2026 Defiant Inc. Copyright Information: 1999-2026 The MITRE Corporation Contact For any errors or if you require more information, please contact: wfi-support@wordfence.com Business Hours US Eastern Time: 9am-8pm US Pacific Time: 6am-5pm UTC/GMT: 2pm-1am Excludes weekends and holidays 24/7/365 customer support with a 1-hour response time Terms of Service Terms of Service Privacy Policy and Notice of Collection Do Not Sell or Share My Personal Information Social Media X Facebook LinkedIn Instagram Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog News Vulnerability Announcements About About Wordfence Affiliate Program Careers Contact Security CVE Request Form Subscribe for Updates Subscribe to our news and updates from our dashboard of experienced security professionals. Email: you@example.com By checking this box, I agree to the Terms of Service and Privacy Policy. Register Copyright © 2012-2026 Defiant Inc. All rights reserved Partners Checkmarx

Goal Reached Thanks to every supporter — we hit 100%!

TranslatePress <= 3.2.5 Unauthenticated Stored XSS Advisory (CVE-2026-75981)

More from this source