CVE-2026-121765: WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability

Q: Which TranslatePress versions are affected?

The issue affects TranslatePress through version 3.3.8. The available data does not identify a fixed version.

Q: Is this a stored or reflected XSS issue?

This is a stored XSS vulnerability, meaning malicious input can be saved and later rendered in web pages.

Published Nov 7, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.8.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cozmoslabs TranslatePress translatepress-multilingual to a version that resolves this vulnerability.
Fixed in 3.3.9

Event History

Nov 7, 2026

CVE Published

via MITRE·11:59 AM

Data Sourced

via MITRE·11:59 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which TranslatePress versions are affected?

The issue affects TranslatePress through version 3.3.8. The available data does not identify a fixed version.

Is this a stored or reflected XSS issue?

This is a stored XSS vulnerability, meaning malicious input can be saved and later rendered in web pages.

CVE-2026-121765: WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Which TranslatePress versions are affected?

Is this a stored or reflected XSS issue?

Company

Resources

Contact

Frequently Asked Questions

Which TranslatePress versions are affected?

Is this a stored or reflected XSS issue?