CVE-2026-76053

Name of the Vulnerable Software and Affected Versions TranslatePress – Translate Multilingual sites with AI Translation versions prior to 3.3.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This is possible because the WordPress comment KSES allowlist permits a specific payload structure consisting of an anchor tag with href and title attributes and a code tag. This allows malicious comments to be stored in the database and subsequently processed by the vulnerable HTML parser during page translation.

Recommendations Update to version 3.3.4 or later.