TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via #TRPLINKPROCESSED Marker in URLs
- ID
- WPSEC-2026-0965
- Plugin
- TranslatePress – Translate Multilingual sites with AI Translation (translatepress-multilingual)
- Affected
- all versions before 3.3.8
- Remediation
- Update to 3.3.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-14
- Attack surface
- TranslatePress – Translate Multilingual sites with AI Translation on WPSec AttackSurface
- Fix released
- Published
Description
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the internal #TRPLINKPROCESSED link marker in all versions up to, and including, 3.3.7. This is due to the plugin removing the marker from link href, form action and link element URLs after WordPress's and the plugin's own URL scheme checks have already run, without checking the result again, so a marker placed inside a link URL can hide a javascript: URL from those checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through links in comments that execute when a user views the translated version of an injected page and clicks the link.
References
- https://wpsec.com/vuln/WPSEC-2026-0965/
- https://plugins.svn.wordpress.org/translatepress-multilingual/tags/3.3.8/
- https://wordpress.org/plugins/translatepress-multilingual/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS