CVE-2026-18510 in TranslatePress Plugin
Summary
by MITRE • 08/06/2026
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The TranslatePress plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 326. This security flaw resides in the plugin's handling of comment content where URL-encoded gettext markers are processed without adequate input sanitization or output escaping mechanisms. The vulnerability specifically targets the plugin's translation functionality that processes multilingual content through WordPress's comment system, creating a persistent attack vector that can compromise user sessions and execute malicious code within the context of affected websites.
The technical implementation of this vulnerability stems from insufficient validation of user-supplied input during comment processing within the TranslatePress plugin. When users submit comments containing URL-encoded gettext markers, these inputs are not properly sanitized before being stored in the database or rendered on web pages. The flaw allows attackers to inject malicious scripts that will execute whenever any user accesses a page containing the compromised comment. This represents a classic stored XSS vulnerability where the payload persists server-side and executes against multiple users over time, rather than requiring immediate interaction with the vulnerable input field.
The operational impact of this vulnerability extends beyond simple script execution as it can enable complete session hijacking, data theft, and potential lateral movement within compromised WordPress environments. Attackers can craft malicious comment payloads that exploit the URL-encoded gettext markers to bypass standard wp_kses validation processes since these encoded characters are permitted by WordPress's default sanitization rules. Even though comment moderation may delay initial exploitation for first-time commenters, this protection is insufficient as the encoded payload can pass through all validation layers unmodified, allowing persistent execution against any user who views the affected content.
This vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and maps to several ATT&CK techniques including T1566 for initial access through malicious content and T1059 for command and control through script injection. The attack surface is particularly concerning given that WordPress remains one of the most widely deployed content management systems with millions of installations, making this vulnerability potentially exploitable across a vast number of target environments. Organizations using TranslatePress plugins should immediately implement mitigations including plugin updates to versions that address the sanitization gap, input validation hardening, and comprehensive monitoring for malicious comment submissions.
The root cause analysis reveals that the plugin's developers failed to implement proper context-aware escaping mechanisms when processing translation markers within comment contexts. Standard security practices dictate that all user-supplied content must be escaped according to the output context where it will be rendered, particularly in HTML environments where script execution is possible. The failure to apply appropriate sanitization during comment storage creates a persistent threat vector that can be exploited by attackers without requiring authentication or privileged access to the WordPress installation. This vulnerability demonstrates the critical importance of input validation and output escaping in preventing XSS attacks, especially within plugins that process user-generated content through translation workflows.
Mitigation strategies should include immediate patching of the TranslatePress plugin to version 327 or later where proper sanitization has been implemented. Organizations should also implement additional defensive measures such as restricting comment submission permissions for untrusted users, implementing web application firewalls with XSS detection capabilities, and conducting regular security audits of installed plugins. The vulnerability serves as a reminder that even seemingly benign functionality like translation services can introduce critical security risks when proper input validation is not implemented, particularly in content management systems where user-generated content processing is common.