Unauthenticated Stored XSS in TranslatePress Plugin

The TranslatePress plugin for WordPress (versions 3.2.5 and below) contains a critical security flaw that enables unauthenticated stored cross-site scripting (XSS). The vulnerability exists within the 'translate_page' function in 'includes/class-translation-render.php', which performs an unconditional replacement of the custom gettext markers '#!trpst#' and '#!trpen#' with the HTML brackets '<' and '>'. Because these markers are treated as plain text by standard WordPress sanitization filters like 'wp_kses', they pass through unchanged into the database. When a visitor views a post or comment in a language targeted by the plugin, the rendering engine replaces the markers with HTML tags, allowing an attacker to inject arbitrary HTML, including event handlers like 'onerror'. Because the plugin's 'remove_tags_from_output' function only targets '<script>' and '<style>' tags, attackers can successfully execute JavaScript using alternative tags such as '<img>'. This vulnerability poses a significant risk to site visitors, potentially leading to session theft or administrative account compromise if a privileged user views the injected content.

Attack Chain

1. Attacker identifies a WordPress site utilizing the vulnerable TranslatePress plugin (version <= 3.2.5).
2. Attacker crafts a malicious payload using the plugin's specific markers, such as '#!trpst#img src=x onerror=alert(1)#!trpen#'.
3. Attacker submits the payload via a vector that accepts user-supplied content, such as a post comment or a custom form field.
4. The WordPress site stores the payload in the database because 'wp_kses' does not recognize the markers as HTML.
5. The attacker waits for an unsuspecting victim or site administrator to load the page with the TranslatePress plugin enabled.
6. The TranslatePress 'translate_page()' function processes the stored comment and substitutes the markers with real HTML brackets.
7. The browser renders the resulting <img> tag, and the 'onerror' event handler executes the malicious JavaScript payload in the victim's session.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's browser session. This can lead to the theft of session cookies, redirection of users to malicious domains, or unauthorized actions performed on behalf of the logged-in user. Given that WordPress sites often attract administrative users to comment threads or post editing interfaces, the risk of credential or session hijacking is high.

Recommendation

• Immediately update the TranslatePress plugin to the latest version, which contains the patch for this vulnerability.
• Audit existing comments and posts on the site for the presence of the '#!trpst#' or '#!trpen#' substrings as an indicator of potential past exploitation.
• Implement a strong Content Security Policy (CSP) to restrict the execution of unauthorized scripts and mitigate the impact of potential XSS vulnerabilities.