CVE-2026-96575 in Transliterator Plugin
Summary
by MITRE • 10/03/2026
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives WordPress comment save-time sanitization because the tags and attributes used (such as a[title] and code) are permitted by the core comment kses allow-list, and the literal characters comprising the plugin's shortcode markers and placeholder tokens are not stripped.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress contains a critical security vulnerability affecting all versions up to 2.5.8. This flaw manifests as a Stored Cross-Site Scripting issue, which is classified under CWE-79 in the Common Weakness Enumeration framework. The root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin's handling of comment content. Unlike many other vulnerabilities that require authentication or specific administrative privileges to exploit, this vulnerability allows unauthenticated attackers to inject malicious web scripts directly into pages through the comment section. This significantly lowers the barrier for entry, enabling any visitor with basic technical knowledge to compromise the integrity and security of the targeted WordPress site.
The operational mechanism of this attack relies on the interaction between the plugin's shortcode processing logic and WordPress core's content filtering system. When a user submits a comment containing specific malicious payloads, these inputs are processed by the Transliterator plugin before being stored in the database. The vulnerability arises because the plugin uses predictable placeholder tokens, specifically those involving rstr_keep markers, to manage text conversion tasks. These placeholders are not adequately sanitized or escaped during the processing phase. Consequently, when a page containing such comments is rendered for other users, the browser interprets the injected scripts as legitimate code rather than plain text. This leads to the execution of arbitrary JavaScript in the context of the victim's session, potentially allowing attackers to steal cookies, hijack user sessions, deface websites, or perform actions on behalf of authenticated users if they interact with malicious links embedded within the script.
A key factor enabling this exploit is that WordPress core employs a strict allow-list known as kses for sanitizing comment content. This system permits certain HTML tags and attributes deemed safe, such as anchor tags with title attributes and code blocks. The attacker leverages this by crafting payloads using these permitted elements to encapsulate malicious JavaScript execution vectors. Because the plugin's shortcode markers and placeholder tokens are not stripped or properly escaped before being passed through the kses filter, they survive the sanitization process intact. This allows the malicious payload to persist in the database as stored content rather than being filtered out during submission. The persistence of this data means that every subsequent page load for any user viewing the affected comment will trigger the execution of the injected script, creating a widespread and persistent threat vector across all visitors who view the compromised pages.
From an ATT&CK perspective, this vulnerability aligns with techniques involving client-side code injection and potentially credential harvesting or session hijacking if combined with other attack vectors like phishing links embedded in the XSS payload. The lack of proper output escaping represents a fundamental failure in defense-in-depth strategies commonly expected in modern web application development standards such as OWASP Top Ten guidelines regarding Injection flaws. To mitigate this risk, immediate action is required from site administrators and developers maintaining WordPress installations using the Transliterator plugin. Updating to version 2.5.9 or later resolves the issue by implementing stricter sanitization routines that properly escape output and remove dangerous placeholder patterns before they can be processed into HTML content. Until an update is applied, temporary mitigations may include disabling comments on affected pages if feasible, although this reduces functionality. Additionally, deploying a Web Application Firewall with rules specifically targeting XSS payloads involving anchor tags and code blocks containing script execution attempts can provide partial protection against exploitation by blocking malicious requests before they reach the application layer.