CVE-2026-107768: TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

Q: Which sites are exposed to exploitation?

Sites using affected TranslatePress versions are exposed if they allow unmoderated comment submission on at least one post and have a secondary language configured. An attacker does not need an account or other privileges.

Q: What must an attacker do to trigger the issue?

The attacker submits a crafted comment containing malicious content in the comment parameter. The stored script executes when a user accesses the page containing the injected comment.

Q: Are sites with moderated comments affected in the same way?

The provided exploit conditions specifically require unmoderated comment submission. The data does not establish whether moderated comments can be used to exploit the issue.

Q: How can I determine whether my site may be vulnerable?

Check whether TranslatePress is version 3.3.7 or earlier, whether at least one secondary language is configured, and whether comments can be submitted without moderation on any post. Review comments for suspicious anchor href content or the trp-gettext/TRPLINKPROCESSED markers.

Published Oct 16, 2026

Updated

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.

Affected Software

1 affected component

TranslatePress TranslatePress – Translate Multilingual sites with AI Translation<=3.3.7

Event History

Oct 16, 2026

CVE Published

via MITRE·06:41 AM

Data Sourced

via MITRE·06:41 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to exploitation?

Sites using affected TranslatePress versions are exposed if they allow unmoderated comment submission on at least one post and have a secondary language configured. An attacker does not need an account or other privileges.

What must an attacker do to trigger the issue?

The attacker submits a crafted comment containing malicious content in the comment parameter. The stored script executes when a user accesses the page containing the injected comment.

Are sites with moderated comments affected in the same way?

The provided exploit conditions specifically require unmoderated comment submission. The data does not establish whether moderated comments can be used to exploit the issue.

How can I determine whether my site may be vulnerable?

Check whether TranslatePress is version 3.3.7 or earlier, whether at least one secondary language is configured, and whether comments can be submitted without moderation on any post. Review comments for suspicious anchor href content or the trp-gettext/TRPLINKPROCESSED markers.

CVE-2026-107768: TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

Affected Software

Event History

Frequently Asked Questions

Which sites are exposed to exploitation?

What must an attacker do to trigger the issue?

Are sites with moderated comments affected in the same way?

How can I determine whether my site may be vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to exploitation?

What must an attacker do to trigger the issue?

Are sites with moderated comments affected in the same way?

How can I determine whether my site may be vulnerable?