TranslatePress – Translate Multilingual Sites With AI Translation (<= 3.3.8) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/translatepress--translate-multilingual-sites-with-ai-translation--3.3.8/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 05:59:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTranslatePress: Stored Cross-Site Scripting (CVE-2026-119167)https://feed.craftedsignal.io/briefs/2026-11-translatepress-xss/Sat, 07 Nov 2026 05:59:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-translatepress-xss/The TranslatePress WordPress plugin is vulnerable to Stored Cross-Site Scripting via insufficient sanitization of the comment parameter, allowing unauthenticated attackers to inject malicious scripts.The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability exists in the 'comment' parameter due to insufficient input sanitization and output escaping.

Impact

Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses the affected page. Successful exploitation requires two conditions: the attacker must have a previously approved comment under WordPress's default moderation settings, and the TranslatePress plugin must have a secondary language configured.

Recommendation

  • Upgrade the TranslatePress - Translate Multilingual sites with AI Translation plugin to a version beyond 3.3.8.
  • Review WordPress comment moderation logs for suspicious activity involving previously approved accounts.
  • Implement a Content Security Policy (CSP) to mitigate the impact of stored XSS attacks.
]]>highadvisory