# TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via #TRPLINKPROCESSED Marker in URLs

- **ID:** WPSEC-2026-0965
- **Plugin:** TranslatePress – Translate Multilingual sites with AI Translation (`translatepress-multilingual`), https://wordpress.org/plugins/translatepress-multilingual/
- **Affected versions:** all versions before 3.3.8
- **Fixed in:** 3.3.8 (Update to 3.3.8 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/translatepress-multilingual
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0965/

## Description

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the internal #TRPLINKPROCESSED link marker in all versions up to, and including, 3.3.7. This is due to the plugin removing the marker from link href, form action and link element URLs after WordPress's and the plugin's own URL scheme checks have already run, without checking the result again, so a marker placed inside a link URL can hide a javascript: URL from those checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through links in comments that execute when a user views the translated version of an injected page and clicks the link.

## References

- https://wpsec.com/vuln/WPSEC-2026-0965/
- https://plugins.svn.wordpress.org/translatepress-multilingual/tags/3.3.8/
- https://wordpress.org/plugins/translatepress-multilingual/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0965/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.