TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via URL Scheme Neutralization Bypass
- ID
- WPSEC-2026-2455
- Plugin
- TranslatePress – Translate Multilingual sites with AI Translation (translatepress-multilingual)
- Affected
- from 3.3.7 before 3.3.9
- Remediation
- Update to 3.3.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-04
- Attack surface
- TranslatePress on WPSec AttackSurface
- Fix released
- Published
Description
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL attributes in translated content in versions 3.3.7 up to, and including, 3.3.8, due to a lazy regular expression in the URL-scheme neutralizer that can be pushed past the PCRE backtrack limit by a stray quote far from its closing quote. When that happens the check fails open, and the plugin's marker stripping turns a smuggled value such as java<marker>script: into a live javascript: URL. This makes it possible for attackers who can submit link markup that passes kses filtering, such as unauthenticated visitors posting comments where comments are enabled, to inject arbitrary web scripts into pages that run when a user clicks the injected link. Exploitation requires comments that appear without moderation, a translated page, and enough attacker-supplied content on that page to reach the backtrack limit.
References
- https://wpsec.com/vuln/WPSEC-2026-2455/
- https://plugins.svn.wordpress.org/translatepress-multilingual/tags/3.3.9/
- https://wordpress.org/plugins/translatepress-multilingual/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS