TranslatePress <= 3.3.6 - Unauthenticated Stored Cross-Site Scripting via trp-gettext Markers in URL Attributes
- ID
- WPSEC-2026-0003
- Plugin
- TranslatePress – Translate Multilingual sites with AI Translation (translatepress-multilingual)
- Affected
- all versions before 3.3.7
- Remediation
- Update to 3.3.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- TranslatePress on WPSec AttackSurface
- Fix released
- Published
Description
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via trp-gettext markers placed in URL attributes in all versions up to, and including, 3.3.6 due to insufficient validation of URL schemes after the plugin strips its internal markers and decodes attribute values on output. A marker placed before a javascript: scheme makes the value look like a relative URL, so it passes wp_kses protocol filtering, and removing the marker on translated pages leaves a live script URL. This makes it possible for unauthenticated attackers, via comment content (and contributors and above via post content), to inject arbitrary web scripts that execute when the page is viewed in a translated language. Comment moderation may delay but does not prevent exploitation.
References
- https://wpsec.com/vuln/WPSEC-2026-0003/
- https://plugins.svn.wordpress.org/translatepress-multilingual/tags/3.3.7/
- https://wordpress.org/plugins/translatepress-multilingual/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS