CVE-2026-18512

Name of the Vulnerable Software and Affected Versions TranslatePress – Translate Multilingual sites with AI Translation versions prior to 3.2.7

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs when an approved comment body is rendered within the Translation Editor Strings dropdown, enabling the injection of arbitrary web scripts that execute when a user accesses the affected page.

Recommendations Update TranslatePress – Translate Multilingual sites with AI Translation to version 3.2.7 or later.