CVE-2026-107768

Name of the Vulnerable Software and Affected Versions TranslatePress – Translate Multilingual sites with AI Translation versions prior to 3.3.8

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the comment parameter. These scripts execute when a user accesses the affected page. Successful exploitation requires the site to allow unmoderated comment submission on at least one post and have a secondary language configured.

Recommendations Update TranslatePress – Translate Multilingual sites with AI Translation to version 3.3.8 or later. As a temporary mitigation, restrict unmoderated comment submissions on posts.