CVE-2026-75981

Name of the Vulnerable Software and Affected Versions TranslatePress – Translate Multilingual sites with AI Translation versions prior to 3.2.6

Description An unauthenticated attacker can perform Stored Cross-Site Scripting by embedding specific gettext markers in a comment. The translate page() function in includes/class-translation-render.php unconditionally rewrites the markers #!trpst# and #!trpen# into < and > characters. Since these markers are treated as plain text, they bypass the wp kses filter. When the content is viewed in a secondary language, the substitution creates actual HTML tags. Because the remove tags from output() function only removes <script> and <style> tags, an attacker can use an <img> tag with an onerror attribute to execute arbitrary code in the visitor's browser.

Recommendations Update to a version newer than 3.2.5.