Description

Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:32.547Z",
  "pubdate": "2026-08-20T12:16:32.547Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the TranslatePress plugin in versions <= 3.3.2. This security flaw enables remote attackers to inject malicious JavaScript payloads into web pages rendered by the affected software. The primary impact of this vulnerability includes the potential execution of arbitrary script code in the context of a victim's browser session, leading to session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users.\nThe affected system is the TranslatePress product operating at version 3.3.2 or earlier. The risk implications are severe due to the unauthenticated nature of the vulnerability, meaning that threat actors require no prior access, credentials, or specific privileges to initiate an attack. Exploitation relies on the application failing to properly sanitize or encode user-supplied input before reflecting it back to the client browser. Consequently, any web visitor interacting with a maliciously crafted URL or input parameter can fall victim to the injected payload, significantly broadening the surface for client-side compromise.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input sanitization and output encoding within the TranslatePress codebase for versions <= 3.3.2. Specifically, the application accepts user-supplied parameters through HTTP requests without adequately validating or neutralizing characters that carry special meaning in HTML and JavaScript contexts, such as angle brackets (<, >) and quote characters.\nThe vulnerability is exposed over the network via HTTP/HTTPS protocols, making it accessible to any unauthenticated remote attacker. No authentication requirements or privilege requirements are needed to interact with the vulnerable component, enabling arbitrary external entities to craft and deploy malicious Uniform Resource Locators (URLs) or submission vectors.\nThe attack flow begins when an unauthenticated attacker crafts a specialized payload containing malicious JavaScript. The attacker delivers this payload to the vulnerable endpoint within the TranslatePress installation, typically via manipulated query string parameters or input fields. Because the application processes the input and reflects it directly into the Document Object Model (DOM) without proper context-aware escaping, the browser interprets the injected data as executable script rather than benign text.\nUpon rendering the response, the client browser executes the payload within the security context of the victim's session. The payload behavior can vary depending on the attacker's objectives, ranging from capturing session cookies and local storage tokens to performing unauthorized administrative actions if the victim holds elevated privileges. The post-exploitation impact includes full compromise of the user session, defacement of the affected web page, or redirection to malicious external domains."
}