CVE-2026-18510: TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wpkses URL validation unmodified.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TranslatePress – Translate Multilingual sites with AI Translationto a version that resolves this vulnerability.Fixed in 3.2.6Patch TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18510?
CVE-2026-18510 has a severity rating of 7.2, classified as high.
How does CVE-2026-18510 affect WordPress sites?
CVE-2026-18510 allows for unauthenticated stored cross-site scripting via comment content, impacting security.
What versions of TranslatePress are affected by CVE-2026-18510?
CVE-2026-18510 affects all versions of TranslatePress up to and including 3.2.6.
How can I mitigate the risk of CVE-2026-18510?
To mitigate CVE-2026-18510, it is recommended to update TranslatePress to a version beyond 3.2.6.
What type of vulnerability is CVE-2026-18510?
CVE-2026-18510 is classified as a stored cross-site scripting (XSS) vulnerability.