CVE-2026-17505 in TranslatePress Plugin
Summary
by MITRE • 08/05/2026
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input — allowing the attacker to bypass WordPress's normal HTML escaping by using these tokens, which are not HTML special characters, in the search query. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The Translate Multilingual sites – TranslatePress plugin for WordPress presents a critical reflected cross-site scripting vulnerability that affects versions up to and including 3.2.5. This security flaw stems from improper handling of HTML marker tokens within the translate_page() function, creating an avenue for attackers to execute malicious scripts in users' browsers. The vulnerability specifically leverages the 's' parameter in search queries, allowing unauthenticated attackers to craft malicious payloads that can compromise user sessions and execute arbitrary code on vulnerable websites.
The technical mechanism behind this vulnerability involves the translate_page() function's unconditional replacement of internal marker tokens #trpen# with literal angle brackets across the entire HTML page output. This process occurs after WordPress has already sanitized and escaped user input, effectively creating a bypass of the platform's normal security measures. The attacker exploits the fact that these tokens are not HTML special characters, enabling them to inject malicious scripts that would otherwise be neutralized by standard escaping mechanisms. This particular approach demonstrates a sophisticated understanding of how to circumvent WordPress's built-in protection systems through token manipulation rather than direct input injection.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to perform a wide range of malicious activities including session hijacking, data theft, and redirection to malicious sites. The reflected nature of the attack means that users must be tricked into clicking on specially crafted links containing the malicious payload, making social engineering a crucial component of successful exploitation attempts. This vulnerability affects any WordPress site running the vulnerable TranslatePress plugin version, potentially compromising thousands of websites across different industries and organizations.
Security practitioners should immediately implement mitigation strategies focusing on plugin updates and input validation measures to address this vulnerability effectively. The recommended approach includes updating to the latest plugin version that addresses this specific XSS flaw, implementing comprehensive input sanitization at multiple layers, and establishing monitoring systems to detect suspicious search parameter usage. Additionally, organizations should consider implementing web application firewalls and content security policies to provide additional defense-in-depth measures against similar vulnerabilities. This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in software applications, and represents a typical ATT&CK technique categorized under T1203 - Exploitation for Client Execution, where adversaries leverage web application vulnerabilities to execute malicious code on victim systems through user interaction.
The broader implications of this vulnerability highlight the critical importance of proper input handling and escaping mechanisms within content management systems. It demonstrates how seemingly benign plugin functionality can create security gaps when internal token replacement processes bypass standard sanitization procedures. Organizations should conduct thorough security assessments of their WordPress installations, particularly focusing on third-party plugins that handle user input or perform complex text manipulation operations. Regular vulnerability scanning and security audits become essential practices to identify and remediate similar issues before they can be exploited by malicious actors in the wild.