Stored Cross-Site Scripting in TranslatePress Plugin for WordPress

CVE-2026-119167

What is CVE-2026-119167?

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability through the 'comment' parameter in versions up to and including 3.3.8. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious web scripts. The malicious scripts execute when a user accesses a compromised page, but successful exploitation requires that the attacker has a previously approved comment associated with their name and email under WordPress's default comment moderation settings, and that a secondary language is set up in the plugin.

References