The vulnerability allows an attacker to store unsanitized HTML/JavaScript in a comment-related attribute handled by the trp-ajax.php dictionary endpoint. When users load the affected pages, the malicious code executes in their browsers, potentially stealing session cookies or injecting further malicious content. This attack does not require privileged access and can affect all visitors to the site.

The TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin is affected in all releases up to and including 3.3.8 deployed by websites that use that version. Any WordPress site running a vulnerable instance of the plugin is at risk.

The CVSS score of 7.2 indicates a high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending crafted requests to the trp-ajax.php endpoint, which is accessible without authentication, and by embedding script payloads in the comment attribute. Once injected, the stored script runs for any user who views the modified page. The lack of input sanitization and output escaping is the core weakness identified by CWE‑79.