Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-10-04T09:16:37.263Z",
  "pubdate": "2026-10-04T09:16:37.263Z",
  "executiveSummary": "TranslatePress-Multilingual versions from n/a through 3.3.6 are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThe vulnerability arises due to improper neutralization of input during web page generation, allowing an authenticated or unauthenticated attacker to inject malicious scripts into the application.\nSuccessful exploitation allows for the execution of arbitrary JavaScript within the context of a victim's browser session.\nThe potential impact includes session hijacking, unauthorized actions performed on behalf of the victim, sensitive data exfiltration, and redirection to malicious domains.\nThe vulnerability necessitates that an attacker can successfully store malicious payloads within the application's database, which are subsequently rendered in the browser of other users, including administrative personnel.",
  "technicalDetails": "The vulnerability is identified as an Improper Neutralization of Input During Web Page Generation, commonly referred to as Stored XSS.\nThis occurs when the TranslatePress-Multilingual plugin fails to adequately sanitize or encode user-supplied input before storing it in the database and rendering it on pages.\nWhen a user or administrator subsequently views the compromised page, the application serves the stored, malicious script, which is then interpreted and executed by the victim's browser.\nThe attack flow begins when an attacker identifies an input vector within the TranslatePress functionality that lacks server-side input validation or output encoding.\nThe attacker submits a payload containing crafted JavaScript tags—such as <script>alert(document.cookie)</script>—via the vulnerable input field.\nThe plugin saves this malicious payload directly into the WordPress database without performing necessary sanitization operations like esc_html() or esc_attr() upon storage or rendering.\nUpon a victim accessing the page where this stored content is displayed, the browser interprets the injected payload as executable code.\nThe execution happens within the security context of the origin, granting the injected script the ability to access document.cookie, interact with the DOM, and perform asynchronous requests to internal API endpoints using the victim's authenticated session.\nPost-exploitation activities are limited only by the privileges of the victim. If an administrator views the stored XSS payload, the attacker can leverage the administrative session to perform high-privilege actions, such as modifying plugin settings, creating new administrative accounts, or injecting further malicious content into the WordPress environment.\nThe vulnerability affects TranslatePress-Multilingual versions from n/a through 3.3.6.\nThe root cause is a failure to enforce strict input sanitization and output escaping patterns for user-supplied data that is persistent across different user sessions."
}