CVE-2026-18512: TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPressto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with Subscriber-level access or higher. They can use an approved comment body to inject script content.
When does the injected script execute?
The injected script executes when a user accesses an affected page. The vulnerable rendering path is the Translation Editor strings dropdown.
Which installations are affected?
TranslatePress versions up to and including 3.2.6 are affected. The provided information does not identify any configuration prerequisite beyond the ability to submit an approved comment.