# TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via URL Scheme Neutralization Bypass

- **ID:** WPSEC-2026-2455
- **Plugin:** TranslatePress – Translate Multilingual sites with AI Translation (`translatepress-multilingual`), https://wordpress.org/plugins/translatepress-multilingual/
- **Affected versions:** from 3.3.7 before 3.3.9
- **Fixed in:** 3.3.9 (Update to 3.3.9 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/translatepress-multilingual
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2455/

## Description

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL attributes in translated content in versions 3.3.7 up to, and including, 3.3.8, due to a lazy regular expression in the URL-scheme neutralizer that can be pushed past the PCRE backtrack limit by a stray quote far from its closing quote. When that happens the check fails open, and the plugin's marker stripping turns a smuggled value such as java<marker>script: into a live javascript: URL. This makes it possible for attackers who can submit link markup that passes kses filtering, such as unauthenticated visitors posting comments where comments are enabled, to inject arbitrary web scripts into pages that run when a user clicks the injected link. Exploitation requires comments that appear without moderation, a translated page, and enough attacker-supplied content on that page to reach the backtrack limit.

## References

- https://wpsec.com/vuln/WPSEC-2026-2455/
- https://plugins.svn.wordpress.org/translatepress-multilingual/tags/3.3.9/
- https://wordpress.org/plugins/translatepress-multilingual/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2455/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.