Stored Cross-Site Scripting in TranslatePress WordPress Plugin

The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.5. The vulnerability stems from improper input sanitization and output escaping within the Translation Memory Suggestion Panel. Specifically, the plugin uses html_entity_decode() on input payloads before persistence into the database, and the relevant column is explicitly exempt from kses filtering. This allows unauthenticated attackers to inject malicious HTML and JavaScript into the translation dictionary. When an administrator later views the affected translation page, the payload is rendered via v-html and executed within their browser session. This flaw could lead to unauthorized administrative actions, session hijacking, or site-wide impact if the script performs further malicious operations.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator session. This can lead to full site compromise, unauthorized configuration changes, or the exfiltration of sensitive data, affecting any WordPress installation running the vulnerable TranslatePress version.

Recommendation

Prioritize the update of the TranslatePress plugin to the latest version. Monitor web server access logs for anomalous POST requests directed at endpoints responsible for saving translation memory data. Review the site's WordPress installation for unauthorized modifications to translation dictionary tables. Ensure that Content Security Policy (CSP) headers are implemented to mitigate the impact of potential XSS attacks.