sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total14
Critical2
High10
Medium2
Reset
Showing 1-14 of 14 records
Threat Entry Updated 2026-11-07

Translatepress Multilingual - Security Vulnerability (CVE-2026-120537)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (storage); originals / language / original_language (exfiltration from endpoint)' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Translatepress Multilingual

CVE-2026-120537

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Translatepress Multilingual - Security Vulnerability (CVE-2026-119167)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that at least one prior comment from the attacker's name and email pair has been approved under WordPress's default comment_previously_approved moderation setting, and that a…

PLUGIN Translatepress Multilingual

CVE-2026-119167

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-09-23

Translatepress Multilingual - Security Vulnerability (CVE-2026-89412)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence,…

PLUGIN Translatepress Multilingual

CVE-2026-89412

HIGH CVSS 7.2 2026-09-22
Open Full Technical Breakdown
Threat Entry Updated 2026-08-28

Translatepress Multilingual - Cross-Site Scripting (XSS) (CVE-2026-76053)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure — an anchor tag with href and title attributes alongside a code tag…

PLUGIN Translatepress Multilingual

CVE-2026-76053

HIGH CVSS 7.2 2026-08-28
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Translatepress Multilingual - Information Disclosure (CVE-2026-19632)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a…

PLUGIN Translatepress Multilingual

CVE-2026-19632

CRITICAL CVSS 9.8 2026-08-26
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Translatepress Multilingual - Cross-Site Scripting (XSS) (CVE-2026-18512)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Translatepress Multilingual

CVE-2026-18512

MEDIUM CVSS 6.4 2026-08-25
Open Full Technical Breakdown
Threat Entry Updated 2026-11-09

Translatepress Multilingual - Cross-Site Scripting (XSS) (CVE-2026-75981)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real tag. remove_tags_from_output()…

PLUGIN Translatepress Multilingual

CVE-2026-75981

HIGH CVSS 7.2 2026-08-19
Open Full Technical Breakdown
Threat Entry Updated 2026-08-12

Translatepress Multilingual - Cross-Site Scripting (XSS) (CVE-2026-18510)

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that…

PLUGIN Translatepress Multilingual

CVE-2026-18510

HIGH CVSS 7.2 2026-08-06
Open Full Technical Breakdown
Threat Entry Updated 2026-08-12

Translatepress Multilingual - Cross-Site Scripting (XSS) (CVE-2026-17505)

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input — allowing the attacker to bypass WordPress's normal HTML escaping by using these tokens, which are not HTML special characters, in the search query. This makes it possible…

PLUGIN Translatepress Multilingual

CVE-2026-17505

MEDIUM CVSS 6.1 2026-08-05
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.