CVE-2026-18510

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.2.7

Description The TranslatePress plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via comment content using URL-encoded gettext markers. These scripts execute when a user accesses the affected page. The attack bypasses wp kses URL validation by using WordPress-permitted tags and attributes with percent-encoded characters. While comment moderation may delay the process for new commenters, it does not prevent the execution of the scripts.

Recommendations Update the plugin to version 3.2.7 or later.