Stored XSS in TranslatePress Plugin via URL-Encoded Gettext Markers

The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.2.6. The vulnerability stems from inadequate input sanitization and output escaping when processing URL-encoded gettext markers within comment content.

Because the malicious payload utilizes percent-encoded characters, it successfully circumvents the WordPress wp_kses filtering mechanism, which typically validates tags and attributes. While WordPress's comment moderation feature may introduce a minor delay for unauthenticated users, it does not prevent the persistent injection of the script. Once successfully injected into a comment, the script executes within the context of any user who views the compromised page. This poses a significant risk for administrative account compromise or session hijacking, as the script triggers automatically upon page load.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of victims viewing affected pages. This can lead to session hijacking, unauthorized actions performed on behalf of authenticated users, or the redirection of visitors to malicious sites. The vulnerability affects all sites running TranslatePress versions 3.2.6 and earlier.

Recommendation

• Immediately update the TranslatePress plugin to the latest available version beyond 3.2.6.
• If updating is not possible, disable the comment feature or utilize a Web Application Firewall (WAF) to block requests containing anomalous URL-encoded patterns commonly associated with XSS payloads targeting gettext markers.
• Deploy webserver logging to monitor for anomalous POST requests containing encoded script tags in comment submission parameters.