CVE-2026-96575: Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstrkeep} Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives WordPress comment save-time sanitization because the tags and attributes used (such as a[title] and code) are permitted by the core comment kses allow-list, and the literal characters comprising the plugin's shortcode markers and placeholder tokens are not stripped.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it by submitting crafted comment content. No existing WordPress account or other privileges are required.
What interaction is needed for the injected script to run?
The malicious script executes when a user accesses a page containing the attacker’s injected comment. The attacker does not need to interact directly with the victim.
Why can the malicious content persist in comments?
The payload can survive WordPress comment save-time sanitization because it uses tags and attributes permitted by the core comment KSES allow-list, including examples such as a[title] and code. The plugin’s shortcode markers and placeholder-token characters are also not stripped.
Which plugin versions are affected?
All versions up to and including 2.5.8 are affected.