CVE-2026-107768: TranslatePress WordPress XSS Vulnerability

CVE-2026-107768 Overview

CVE-2026-107768 is a Stored Cross-Site Scripting (XSS) vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress. The flaw affects all versions up to and including 3.3.7. The issue stems from insufficient input sanitization and output escaping on the comment parameter inside the plugin's translation render logic. Unauthenticated attackers can inject arbitrary JavaScript that executes when any visitor loads an affected page. Exploitation requires the target site to accept unmoderated comments on at least one post and to have a secondary language configured, which aligns with the plugin's primary multilingual use case.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into translated WordPress pages, enabling session theft, administrative action hijacking, and visitor browser compromise.

Affected Products

TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress
All versions up to and including 3.3.7
WordPress sites with secondary language configured and unmoderated comments enabled

Discovery Timeline

2026-10-16 - CVE-2026-107768 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107768

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw classified under CWE-79. TranslatePress renders translated page content, including user-submitted comments, through its class-translation-render.php module. The affected code paths at lines 835, 1355, and 1655 process the comment parameter without applying adequate sanitization or output escaping.

An unauthenticated attacker submits a comment containing a malicious script payload. When the plugin renders the translated version of the page, the payload is written into the HTML response. Every subsequent visitor to the translated page executes the injected script in their browser session.

The attack succeeds against sites that allow comment submission without moderation and have a secondary language configured. Both prerequisites represent default or expected deployment states for TranslatePress users.

Root Cause

The plugin fails to sanitize comment input before storage and does not escape the comment content on output within the translation rendering pipeline. The vendor addressed this in WordPress Changeset 3744262, which modifies the handling in class-translation-render.php.

Attack Vector

The attack is network-reachable, requires no privileges, and requires no user interaction beyond a victim visiting a translated page. An attacker submits a crafted comment to any post with open commenting enabled. The payload is persisted in the comment store. When a visitor requests the translated version of the post, the plugin injects the attacker-controlled script into the rendered HTML.

The injected JavaScript runs in the browser context of every visitor, including authenticated administrators, enabling session cookie theft, forced administrative actions via CSRF, credential harvesting via injected forms, and redirection to attacker-controlled infrastructure.

See the Wordfence Vulnerability Report and the vulnerable code at translation render line 835 for the technical details.

Detection Methods for CVE-2026-107768

Indicators of Compromise

Comment records containing <script>, onerror=, onload=, javascript:, or encoded script fragments stored in the WordPress wp_comments table
HTTP responses from translated page URLs that include unescaped <script> tags originating from comment content
Unexpected outbound requests from visitor browsers to attacker-controlled domains after visiting translated posts
Administrator sessions showing unexplained privileged actions following visits to translated pages

Detection Strategies

Query the WordPress comments database for entries matching common XSS payload patterns, focusing on comments submitted after plugin deployment
Inspect rendered HTML of translated pages for unexpected script tags or event handler attributes within comment sections
Deploy a Web Application Firewall (WAF) rule to log and alert on POST requests to wp-comments-post.php containing script-like payloads

Monitoring Recommendations

Monitor WordPress access logs for anomalous POST activity against comment endpoints from unauthenticated sources
Alert on browser Content Security Policy (CSP) violations originating from translated page URLs
Track administrator account activity for session anomalies that correlate with visits to translated posts

How to Mitigate CVE-2026-107768

Immediate Actions Required

Update the TranslatePress plugin to the version published after 3.3.7 that includes Changeset 3744262
Review existing comments on all posts for stored XSS payloads and purge malicious entries
Rotate administrator session cookies and credentials if the site has been publicly accessible with a secondary language configured
Enable comment moderation on all posts until the plugin is patched

Patch Information

The vendor fixed the vulnerability in the commit referenced by WordPress Changeset 3744262, which updates the sanitization and escaping logic in class-translation-render.php. WordPress site administrators should apply the update through the plugin administration interface or via WP-CLI.

Workarounds

Disable comment submission on all posts until the patched plugin version is installed
Enable the WordPress option requiring manual approval for every comment before publication
Deploy a Content Security Policy (CSP) header restricting inline script execution on translated pages
Temporarily disable the TranslatePress plugin if comments cannot be moderated and no patch is available

bash

# Update TranslatePress via WP-CLI once a patched version is available
wp plugin update translatepress-multilingual

# Require manual approval for all comments as an interim mitigation
wp option update comment_moderation 1
wp option update comment_whitelist 0