Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
TranslatePress - Security Vulnerability (CVE-2026-120537)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (storage); originals / language / original_language (exfiltration from endpoint)' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
TranslatePress
CVE-2026-120537
Risk Score
Threat Entry
Updated 2026-11-07
TranslatePress - Security Vulnerability (CVE-2026-119167)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that at least one prior comment from the attacker's name and email pair has been approved under WordPress's default comment_previously_approved moderation setting, and that a…
PLUGIN
TranslatePress
CVE-2026-119167
Risk Score
Threat Entry
Updated 2026-10-06
TranslatePress - Security Vulnerability (CVE-2026-103062)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
PLUGIN
TranslatePress
CVE-2026-103062
Risk Score
Threat Entry
Updated 2026-09-23
TranslatePress - Security Vulnerability (CVE-2026-89412)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence,…
PLUGIN
TranslatePress
CVE-2026-89412
Risk Score
Threat Entry
Updated 2026-08-28
TranslatePress - Cross-Site Scripting (XSS) (CVE-2026-76053)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure — an anchor tag with href and title attributes alongside a code tag…
PLUGIN
TranslatePress
CVE-2026-76053
Risk Score
Threat Entry
Updated 2026-08-26
TranslatePress - Information Disclosure (CVE-2026-19632)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a…
PLUGIN
TranslatePress
CVE-2026-19632
Risk Score
Threat Entry
Updated 2026-08-26
TranslatePress - Cross-Site Scripting (XSS) (CVE-2026-18512)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
TranslatePress
CVE-2026-18512
Risk Score
Threat Entry
Updated 2026-10-12
TranslatePress - Privilege Escalation (CVE-2026-78267)
Unauthenticated Privilege Escalation in TranslatePress
PLUGIN
TranslatePress
CVE-2026-78267
Risk Score
Threat Entry
Updated 2026-08-20
TranslatePress - Cross-Site Scripting (XSS) (CVE-2026-66582)
Unauthenticated Cross Site Scripting (XSS) in TranslatePress
PLUGIN
TranslatePress
CVE-2026-66582
Risk Score
Threat Entry
Updated 2026-11-09
TranslatePress - Cross-Site Scripting (XSS) (CVE-2026-75981)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real tag. remove_tags_from_output()…
PLUGIN
TranslatePress
CVE-2026-75981
Risk Score
Threat Entry
Updated 2026-08-12
TranslatePress - Cross-Site Scripting (XSS) (CVE-2026-18510)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that…
PLUGIN
TranslatePress
CVE-2026-18510
Risk Score
Threat Entry
Updated 2026-06-17
Translatepress - SQL Injection (CVE-2022-3141)
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.
PLUGIN
Translatepress
CVE-2022-3141
Risk Score
Threat Entry
Updated 2026-06-17
Translatepress - Cross-Site Scripting (XSS) (CVE-2021-24610)
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
PLUGIN
Translatepress
CVE-2021-24610
Risk Score