Cozmoslabs Translatepress
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Cozmoslabs Translatepress.
By the Year
In 2026 there have been 8 vulnerabilities in Cozmoslabs Translatepress with an average score of 7.6 out of ten. Last year, in 2025 Translatepress had 2 security vulnerabilities published. That is, 6 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.50
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 8 | 7.60 |
| 2025 | 2 | 8.10 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 8.80 |
| 2021 | 1 | 4.80 |
It may take a day or so for new Translatepress vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Cozmoslabs Translatepress Security Vulnerabilities
TranslatePress <=3.3.3 Stored XSS via Comment Noise-Key Injection
CVE-2026-76053
7.2 - High
- August 28, 2026
The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure an anchor tag with href and title attributes alongside a code tag causing the malicious comment to be stored verbatim in the database, where it is later processed by the vulnerable parser during page translation.
XSS
TranslatePress <=3.3.1 'trp_get_translations_regular' Sensitive Info Exposure
CVE-2026-19632
9.8 - Critical
- August 26, 2026
The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL including the plaintext reset key and login parameters stored in the translation dictionary table enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.
Weak Password Recovery Mechanism for Forgotten Password
TranslatePress WP Plugin 3.2.6 XSS via Translation Editor Strings Dropdown
CVE-2026-18512
6.4 - Medium
- August 25, 2026
The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
XSS
TranslatePress <=3.3.2 Unauth Priv Esc CVE-2026-78267
CVE-2026-78267
9.8 - Critical
- August 24, 2026
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
Incorrect Privilege Assignment
Unauthenticated XSS in TranslatePress <=3.3.2
CVE-2026-66582
7.1 - High
- August 20, 2026
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
XSS
TranslatePress <=3.2.5 Stored XSS via gettext markers
CVE-2026-75981
7.2 - High
- August 19, 2026
The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.
XSS
TranslatePress Plugin XSS via Comment Input (3.2.6)
CVE-2026-18510
7.2 - High
- August 06, 2026
The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified.
XSS
TranslatePress WP plugin <=3.2.5 Reflected XSS via 's'
CVE-2026-17505
6.1 - Medium
- August 05, 2026
The Translate Multilingual sites TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input allowing the attacker to bypass WordPress's normal HTML escaping by using these tokens, which are not HTML special characters, in the search query. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
XSS
TranslatePress <=2.10.2 Untrusted Data Deserialization Leads to Object Injection
CVE-2025-58592
8.1 - High
- November 06, 2025
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.
Marshaling, Unmarshaling
CVE-2025-30773 TranslatePress <=2.9.6 Object Injection via Deserialization
CVE-2025-30773
- March 27, 2025
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.
Marshaling, Unmarshaling
Translate Multilingual Sites WP Plugin SQLi Before 2.3.3
CVE-2022-3141
8.8 - High
- September 19, 2022
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.
SQL Injection
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings
CVE-2021-24610
4.8 - Medium
- September 27, 2021
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Cozmoslabs Translatepress or by Cozmoslabs? Click the Watch button to subscribe.
