CVE-2026-103062: WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges are required and the attack can be conducted over the network with low complexity. However, user interaction is required for exploitation.

Q: What impact is indicated if exploitation succeeds?

The reported impact is low confidentiality, integrity, and availability impact, with scope changed. The vulnerability is classified as stored XSS, meaning injected content may persist and affect subsequent users who encounter it.

Published Oct 4, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

Affected Software

1 affected component

Cozmoslabs TranslatePress<=3.3.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress TranslatePress plugin to a version that resolves this vulnerability.
Fixed in 3.3.7

Event History

Oct 4, 2026

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges are required and the attack can be conducted over the network with low complexity. However, user interaction is required for exploitation.

What impact is indicated if exploitation succeeds?