An attacker can inject malicious JavaScript into a WordPress comment that will be stored verbatim in the database because the plugin’s parser fails to properly sanitize and escape the input. When a page that uses TranslatePress is translated, the embedded script is executed in the context of any user viewing that page, giving the attacker the ability to steal data, deface the site, or perform other client‑side attacks. This vulnerability is a classic stored XSS flaw (CWE‑79).

All instances of the TranslatePress plugin for WordPress through version 3.3.3 are affected. Upgrading to any version newer than 3.3.3 eliminates the exposed code path. No specific OS or configuration details are mentioned, so any WordPress site running an affected plugin version is at risk.

The CVSS score of 7.2 indicates a high severity issue. No EPSS score is listed, but the lack of authentication requirements and the straightforward comment injection vector make exploitation likely for a motivated attacker. The vulnerability is not yet reported in CISA’s KEV catalog. An attacker can simply post a crafted comment containing an anchor and code tag; the comment is preserved by WordPress’s KSES filter and later rendered by the plugin’s HTML parser, resulting in executed JavaScript for any visitor of the translated page.