CVE-2026-17505: TranslatePress Plugin XSS Vulnerability

CVE-2026-17505 Overview

CVE-2026-17505 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Translate Multilingual sites – TranslatePress plugin for WordPress. The flaw affects all versions up to and including 3.2.5. The translate_page() function unconditionally replaces the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output. This substitution occurs after WordPress has already sanitized and escaped user input, allowing attackers to smuggle HTML through the s search parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when a victim clicks a specially crafted link. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victims' browsers, enabling session hijacking, credential theft, and administrator account takeover on WordPress sites running TranslatePress ≤ 3.2.5.

Affected Products

Translate Multilingual sites – TranslatePress plugin for WordPress
All versions up to and including 3.2.5
WordPress sites with TranslatePress search functionality enabled

Discovery Timeline

2026-08-05 - CVE-2026-17505 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-17505

Vulnerability Analysis

The vulnerability stems from an ordering flaw between WordPress's output escaping and TranslatePress's marker-token substitution. WordPress properly sanitizes the s (search) query parameter and HTML-escapes it during page rendering. TranslatePress then runs a post-processing pass in translate_page() that replaces its internal placeholder tokens #!trpst# and #!trpen# with literal < and > characters across the full HTML response.

Because these placeholder tokens are not HTML special characters, WordPress's escape routines do not touch them. An attacker who embeds #!trpst#script#!trpen#alert(1)#!trpst#/script#!trpen# in the s parameter passes through sanitization intact. After TranslatePress rewrites the tokens, the payload materializes as an executable <script> tag in the rendered page.

Root Cause

The root cause is post-sanitization HTML reconstruction. Any transformation that inserts HTML metacharacters after the escaping stage nullifies the security guarantees of the sanitization pipeline. The affected code paths are located in class-translate-press.php (line 443), includes/class-search.php (line 150), and includes/class-translation-render.php (line 538) of the 3.2.5 tag. See the WordPress TranslatePress source browser for the vulnerable logic.

Attack Vector

An attacker crafts a URL containing the marker tokens inside the s search parameter and lures a victim into visiting it (for example through phishing, forum posts, or malvertising). When the victim's browser loads the page, TranslatePress's token substitution converts the encoded tokens into raw angle brackets, producing an executable script in the response. The injected script runs in the origin of the WordPress site, enabling theft of session cookies, forced administrative actions via CSRF, or drive-by redirects. Exploitation requires user interaction but no authentication.

Detection Methods for CVE-2026-17505

Indicators of Compromise

Web server access logs containing the literal strings #!trpst# or #!trpen# in query parameters, especially the s parameter.
Referrer chains showing users arriving at search URLs from external phishing domains or social platforms.
Unexpected outbound requests from admin sessions shortly after visiting a TranslatePress-enabled search page.
WordPress admin accounts exhibiting session activity from unusual IP addresses following a link click.

Detection Strategies

Deploy WAF rules that flag or block requests containing #!trpst# and #!trpen# tokens in any query string parameter.
Inspect HTTP responses for reflected occurrences of these tokens converted to < or > adjacent to attacker-controlled input.
Correlate WordPress wp-login events with prior search-page visits to detect stolen-session reuse.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward access logs to a centralized SIEM for query-string pattern matching.
Monitor plugin version inventory across all WordPress instances and alert on TranslatePress builds at or below 3.2.5.
Track anomalous JavaScript execution and DOM modifications via Content Security Policy (CSP) violation reports.

How to Mitigate CVE-2026-17505

Immediate Actions Required

Update the TranslatePress plugin to the version published in changeset 3624567, which corrects the token replacement logic.
Audit WordPress administrator sessions and force logout of all users to invalidate potentially stolen cookies.
Enable a Web Application Firewall with rules blocking #!trpst# and #!trpen# tokens in inbound requests until patching is complete.

Patch Information

The vendor addressed the issue in a fix committed to the plugin trunk. Refer to the WordPress TranslatePress changeset and the Wordfence Vulnerability Report for patch details and version guidance. Apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

If immediate patching is not possible, disable the TranslatePress plugin until the update is applied.
Deploy a strict Content Security Policy that disallows inline scripts to reduce the impact of reflected XSS payloads.
Configure the WAF to strip or reject any request whose query string contains #!trpst# or #!trpen# substrings.

bash

# Update TranslatePress via WP-CLI
wp plugin update translatepress-multilingual

# Verify installed version is above 3.2.5
wp plugin get translatepress-multilingual --field=version

# Example ModSecurity rule to block marker tokens in query strings
SecRule ARGS "@rx #!trp(st|en)#" \
    "id:1017505,phase:2,deny,status:403,log,\
    msg:'CVE-2026-17505 TranslatePress XSS token detected'"