TranslatePress: Stored Cross-Site Scripting (CVE-2026-119167)
The TranslatePress WordPress plugin is vulnerable to Stored Cross-Site Scripting via insufficient sanitization of the comment parameter, allowing unauthenticated attackers to inject malicious scripts.
CVE search metadata
CVE search record: CVE-2026-119167. Severity: high. CVSS: 7.2. KEV: no. Product: TranslatePress – Translate Multilingual sites with AI Translation (<= 3.3.8). Brief: TranslatePress: Stored Cross-Site Scripting (CVE-2026-119167). Brief link: https://feed.craftedsignal.io/briefs/2026-11-translatepress-xss/
Triage facts
Revision 1- Applicability
- TranslatePress – Translate Multilingual sites with AI Translation (<= 3.3.8)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the 'comment' parameter due to insufficient input sanitization and output escaping.
Impact
Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses the affected page. Successful exploitation requires two conditions: the attacker must have a previously approved comment under WordPress's default moderation settings, and the TranslatePress plugin must have a secondary language configured.
Recommendation
- Upgrade the TranslatePress - Translate Multilingual sites with AI Translation plugin to a version beyond 3.3.8.
- Review WordPress comment moderation logs for suspicious activity involving previously approved accounts.
- Implement a Content Security Policy (CSP) to mitigate the impact of stored XSS attacks.
Immediate actions
Upgrade TranslatePress plugin to version > 3.3.8
Threat Hunt
Inspect WordPress comment database or audit logs for script tags or common XSS payloads in comment bodies.
Data: WordPress database comments table, Web server access logs