CVE-2026-119167

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.3.9

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the comment parameter. Exploitation requires a secondary language to be configured in the plugin and at least one prior comment from the attacker's name and email pair to be approved under the default WordPress comment previously approved moderation setting.

Recommendations Update to version 3.3.9 or later. Avoid using the comment parameter in the affected plugin until the update is applied.