CVE-2026-103062: TranslatePress Stored XSS Vulnerability

CVE-2026-103062 Overview

CVE-2026-103062 is a stored cross-site scripting (XSS) vulnerability in the Cozmoslabs TranslatePress WordPress plugin (translatepress-multilingual). The flaw affects all versions up to and including 3.3.6. It stems from improper neutralization of input during web page generation [CWE-79], allowing attackers to inject persistent JavaScript into translated content.

An attacker can exploit the issue over the network without authentication, though successful exploitation requires user interaction. Because the vulnerability crosses a security scope boundary, injected scripts can execute in the context of other users who view the affected pages, including administrators.

Critical Impact
Stored XSS in TranslatePress enables attackers to execute arbitrary JavaScript in victim browsers, potentially leading to session hijacking, credential theft, or administrative account takeover on affected WordPress sites.

Affected Products

Cozmoslabs TranslatePress Multilingual plugin for WordPress
All versions from unspecified initial release through 3.3.6
WordPress sites using TranslatePress for multilingual content delivery

Discovery Timeline

2026-10-04 - CVE-2026-103062 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103062

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in TranslatePress, a WordPress plugin that enables front-end translation of site content. User-supplied input processed by the plugin is not properly sanitized or encoded before being rendered in generated HTML output.

Because the payload is stored server-side, the injected script executes every time a user loads the affected page. The scope-change characteristic of this issue indicates that script execution can affect components beyond the vulnerable plugin itself, including the broader WordPress session context.

Technical details are available in the Patchstack Vulnerability Report.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. TranslatePress accepts input used in translated content and reflects it into HTML output without sufficient output encoding or input validation. This allows HTML and JavaScript constructs supplied by an attacker to be interpreted by browsers as executable code rather than inert text.

Attack Vector

An unauthenticated attacker delivers a crafted payload to a translation-handling endpoint exposed by the plugin. The payload is stored by the application and later served to any user visiting the affected translated page. Victim interaction, such as loading the page or clicking a crafted link, triggers execution.

Once executed, the attacker-controlled script runs in the victim's browser under the origin of the WordPress site. This enables theft of authentication cookies, forced actions on behalf of logged-in administrators, and injection of further malicious content into the site.

Detection Methods for CVE-2026-103062

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in TranslatePress translation tables within the WordPress database
Outbound requests from site visitors to unknown domains referenced in page source
New or modified WordPress administrator accounts created shortly after translation activity
Browser console errors or Content Security Policy violations tied to translated page URLs

Detection Strategies

Audit the wp_trp_dictionary_* tables and translation metadata for HTML or JavaScript syntax in stored translation strings
Review web server access logs for POST requests to TranslatePress AJAX endpoints containing script-like payloads
Deploy web application firewall rules that flag XSS signatures in requests targeting /wp-admin/admin-ajax.php with TranslatePress actions

Monitoring Recommendations

Monitor WordPress plugin version inventory to identify TranslatePress installations at or below version 3.3.6
Alert on administrator session anomalies, including logins from unexpected geolocations after translation page visits
Track database write operations to translation tables and correlate against known-good editor accounts

How to Mitigate CVE-2026-103062

Immediate Actions Required

Identify all WordPress sites running TranslatePress and determine the installed version
Update TranslatePress to a version later than 3.3.6 once the vendor releases a patched build
Rotate credentials for WordPress administrator and editor accounts that may have viewed attacker-controlled translated pages
Review stored translations and remove any entries containing HTML or JavaScript payloads

Patch Information

The advisory lists affected versions through 3.3.6. Review the Patchstack Vulnerability Report and Cozmoslabs changelog for the fixed release version and apply it through the WordPress plugin updater.

Workarounds

Restrict access to TranslatePress translation editor endpoints using IP allowlisting or authentication requirements at the web server layer
Implement a strict Content Security Policy that disallows inline scripts and unknown script sources
Temporarily disable the TranslatePress plugin on affected sites until a patched version is installed
Deploy WAF signatures that block XSS payloads targeting WordPress AJAX endpoints associated with the plugin

bash

# Example: identify TranslatePress version via WP-CLI
wp plugin get translatepress-multilingual --field=version

# Example: disable the plugin until patched
wp plugin deactivate translatepress-multilingual