A flaw in input sanitization within the TranslatePress – Translate Multilingual sites with AI Translation plugin allows an attacker with subscriber‑level or higher access to inject arbitrary script code into the Approved Comment Body. That code is rendered inside the Translation Editor’s strings dropdown list and executes on any page that contains the affected string, enabling client‑side attacks such as credential theft, defacement, or session hijacking. The weakness is a classic stored XSS flaw (CWE‑79).

Any WordPress site using the TranslatePress plugin up to and including version 3.2.6 is affected. The issue originates from the cozmoslabs:TranslatePress product, and all builds released through the 3.2.x line carry the vulnerability.

The CVSS score of 6.4 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known public exploits yet. Attackers need only authenticating with a subscriber‑level role or higher to create the malicious comment body, and the injected script will run for any visitor who loads a page that displays the translated string. While access is restricted to logged‑in users, the stored nature of the payload means the impact persists until mitigated, affecting all site users who view the impacted pages.