{
 "id": "WPSEC-2026-2455",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2455/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2455/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2455/index.md",
 "title": "TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via URL Scheme Neutralization Bypass",
 "description": "The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL attributes in translated content in versions 3.3.7 up to, and including, 3.3.8, due to a lazy regular expression in the URL-scheme neutralizer that can be pushed past the PCRE backtrack limit by a stray quote far from its closing quote. When that happens the check fails open, and the plugin's marker stripping turns a smuggled value such as java<marker>script: into a live javascript: URL. This makes it possible for attackers who can submit link markup that passes kses filtering, such as unauthenticated visitors posting comments where comments are enabled, to inject arbitrary web scripts into pages that run when a user clicks the injected link. Exploitation requires comments that appear without moderation, a translated page, and enough attacker-supplied content on that page to reach the backtrack limit.",
 "plugin": {
  "slug": "translatepress-multilingual",
  "name": "TranslatePress",
  "full_name": "TranslatePress – Translate Multilingual sites with AI Translation",
  "wordpress_org": "https://wordpress.org/plugins/translatepress-multilingual/",
  "advisories_url": "https://wpsec.com/vuln/plugin/translatepress-multilingual/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/translatepress-multilingual"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.3.7",
    "from_inclusive": true,
    "to": "3.3.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.3.7 before 3.3.9"
  ]
 },
 "introduced_in": "3.3.7",
 "fixed_in": "3.3.9",
 "remediation": "Update to 3.3.9 or later.",
 "fix_released": "2026-11-03T08:54:11+00:00",
 "published": "2026-11-04T09:46:28+00:00",
 "updated": "2026-11-03T13:38:16.069264+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2455/",
  "https://plugins.svn.wordpress.org/translatepress-multilingual/tags/3.3.9/",
  "https://wordpress.org/plugins/translatepress-multilingual/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/translatepress-multilingual",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-04"
 }
}