Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
Published: 2026-10-04
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an improper neutralization of input during web page generation that permits a stored cross‑site scripting flaw in the TranslatePress Multilingual plugin. By inserting crafted content, an attacker can cause arbitrary JavaScript to be executed when site visitors view affected pages. The flaw is classified under CWE‑79.

Affected Systems

WordPress installations that have the TranslatePress plugin from Cozmoslabs, version 3.3.6 or earlier, are susceptible. Any site running a version up to and including 3.3.6 can be impacted, regardless of the site's specific configuration or content structure.

Risk and Exploitability

The issue carries a CVSS score of 7.1, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this stored XSS by adding malicious content through the plugin’s administrative interfaces, affecting all users who view pages where the injected script appears. No additional privileges are needed beyond normal content editing access.

Generated by OpenCVE AI on October 4, 2026 at 10:51 UTC.

Remediation

Vendor Solution

Update the WordPress TranslatePress plugin to the latest available version (at least 3.3.7).

OpenCVE Recommended Actions

  • Update the TranslatePress plugin to version 3.3.7 or later.
  • If a patch cannot be applied immediately, disable or remove the TranslatePress plugin to stop the injection of new malicious content.
  • Review existing content for injected scripts and remove any that remain on the site.

Generated by OpenCVE AI on October 4, 2026 at 10:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 04 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Cozmoslabs
Cozmoslabs translatepress
Wordpress-extensions
Wordpress-extensions translatepress
Vendors & Products Cozmoslabs
Cozmoslabs translatepress
Wordpress-extensions
Wordpress-extensions translatepress

Sun, 04 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
Title WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Cozmoslabs Translatepress
Wordpress-extensions Translatepress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-05T15:31:49.116Z

Reserved: 2026-09-30T00:15:58.644Z

Link: CVE-2026-103062

cve-icon Vulnrichment

Updated: 2026-10-05T14:46:58.236Z

cve-icon NVD

Status : Deferred

Published: 2026-10-04T09:16:37.263

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-103062

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T20:48:51Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')