CVE-2026-76053: TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure — an anchor tag with href and title attributes alongside a code tag — causing the malicious comment to be stored verbatim in the database, where it is later processed by the vulnerable parser during page translation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need authentication or user interaction to submit the malicious content. The attack relies on a crafted WordPress comment that is accepted and stored, then later processed during page translation.
Are default WordPress comment protections sufficient to prevent exploitation?
No. Exploitation is possible because the WordPress comment KSES allowlist permits the relevant anchor and code-tag payload structure, allowing the malicious comment to be stored verbatim.
When does the injected script execute?
The script executes when a user accesses a page containing the injected content after the vulnerable TranslatePress HTML parser processes it during translation. This can affect any user who views the injected page.
How can I determine whether my site is exposed?
Sites using TranslatePress – Translate Multilingual sites with AI Translation version 3.3.3 or earlier are affected. Review stored comments and translated pages for unexpected anchor elements with href and title attributes combined with code tags or other suspicious injected markup.