CVE-2026-18512 in TranslatePress Plugin
Summary
by MITRE • 08/25/2026
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The TranslatePress plugin for WordPress, specifically versions up through 3.2.6, contains a critical security flaw classified as Stored Cross-Site Scripting (XSS). This vulnerability arises from insufficient input sanitization and output escaping mechanisms within the translation editor interface. The specific attack vector involves the Approved Comment Body Rendered in Translation Editor Strings Dropdown. When an administrator or user with appropriate privileges approves a comment containing malicious script code, that content is stored directly into the database without adequate validation. Subsequently, when this data is retrieved for display in the translation strings dropdown within the plugin's administrative interface, it is rendered as executable HTML rather than being treated as plain text. This failure to properly escape special characters allows embedded JavaScript payloads to execute in the context of any user who views that specific string during the translation process.
The operational impact of this vulnerability is significant because it enables authenticated attackers with subscriber-level access and above to inject arbitrary web scripts into pages accessed by other users, particularly administrators or translators. Since WordPress roles such as Subscriber allow for commenting on posts, an attacker can easily trigger the initial injection phase by submitting a comment containing malicious code. Once approved, which may require administrative action depending on site settings, the payload becomes persistent within the application's data store. When any user with access to the translation editor navigates to view or edit strings associated with that content, the browser executes the injected script. This can lead to session hijacking, where an attacker steals authentication cookies and takes over active sessions of privileged users. It also facilitates defacement of the website interface, redirection to phishing sites designed to steal credentials, or further exploitation within the WordPress admin dashboard if combined with other vulnerabilities.
From a classification perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing malicious content that is later executed upon retrieval places it firmly in the Stored XSS category rather than Reflected or DOM-based variants. In terms of threat modeling and attack patterns defined by MITRE ATT&CK, this behavior corresponds to T1059, Command and Control via Application Layer Protocol, specifically when used for initial access through social engineering or compromised accounts, but more accurately maps to T1189 Drive-by Client-Side Script Injection if the goal is immediate exploitation. However, given that it requires authentication first, it also reflects aspects of privilege escalation where a lower-privileged user leverages stored data to impact higher-privileged users interacting with the system's administrative functions.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. The primary remediation is to upgrade the TranslatePress plugin to version 3.2.7 or later, where developers have implemented proper input sanitization using WordPress standard functions like sanitize_text_field and output escaping via esc_html or similar methods before rendering data in the translation editor dropdowns. For organizations unable to patch immediately due to compatibility concerns, temporary mitigations include restricting comment approval workflows so that only high-privilege administrators can approve comments containing HTML tags, thereby reducing the attack surface for lower-level users. Additionally, implementing a Content Security Policy (CSP) header on the WordPress site can help mitigate the impact of successful XSS attacks by preventing the execution of inline scripts unless explicitly whitelisted, although this requires careful configuration to avoid breaking legitimate plugin functionality. Regular security audits and code reviews focusing on data flow from user inputs to administrative interfaces are essential for maintaining long-term resilience against such injection-based vulnerabilities.