The TranslatePress plugin for WordPress contains an unauthenticated cross‑site scripting vulnerability in all releases up to and including 3.3.2. Because input submitted through the plugin does not require authentication, an attacker can inject arbitrary script payloads via any request that reaches the plugin. The flaw can allow attackers to execute malicious JavaScript in the victim’s browser, potentially leading to theft of cookies, session identifiers, or the ability to perform actions on behalf of the user. The weakness is a classic web input validation failure (CWE‑79).

Cozmoslabs TranslatePress plugin for WordPress, versions up to and including 3.3.2, is affected. WordPress sites that have this plugin installed must consider their version relative to the update recommendation.

The CVSS base score is 7.1, indicating a high severity due to impact on browser context and potential data theft. EPSS is not available, so the current exploit probability is unknown, but the fact that the vulnerability is unauthenticated and requires no additional privileges makes it attractive to attackers. The vulnerability is not listed in the CISA KEV catalog, but practitioners should treat it as potentially exploitable. An attacker can exploit this flaw by crafting an HTTP request that sends malicious JavaScript to the plugin, which will be reflected back into the browser without proper sanitization.