The vulnerability in the TranslatePress plugin allows an unauthenticated attacker to store malicious JavaScript through the 'comment' parameter. Because the plugin does not sanitize inputs that include trp-gettext/TRPLINKPROCESSED markers inside anchor href attributes, the stored payload is rendered unescaped on every page that loads the comment. An attacker can therefore run arbitrary scripts in the browsers of all visitors who view the corrupted page.

Any WordPress site that has the TranslatePress multilingual plugin by Cozmos Labs installed with a version not later than 3.3.7 is affected. The issue arises on sites that have at least one post where comments are open and the plugin’s secondary language feature is enabled.

The CVSS score of 7.2 indicates high severity, and the lack of an EPSS score suggests data is unavailable but the vulnerability is still substantial. Because exploitation requires only that comments are unmoderated on a post and a secondary language is configured, the attack vector is straightforward for any website running the affected plugin. Compromise would give the attacker execution in users’ browsers, potentially leading to session hijacking or phishing. Although the vulnerability is not yet catalogued in CISA’s KEV list, its easy exploitation path and high impact make it a priority for remediation.