CVE-2026-18510 Overview
CVE-2026-18510 is a stored Cross-Site Scripting (XSS) vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress. The flaw affects all versions up to and including 3.2.6. Unauthenticated attackers can inject arbitrary web scripts through comment content using URL-encoded gettext markers. The plugin fails to properly sanitize input and escape output when rendering translated comment content. Injected scripts execute in the browsers of any user who accesses the affected page. Comment moderation delays but does not prevent exploitation, because the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that bypass wp_kses URL validation.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, account takeover, and drive-by attacks against site visitors.
Affected Products
- TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress
- All plugin versions up to and including 3.2.6
- Fixed in version 3.3
Discovery Timeline
- 2026-08-06 - CVE-2026-18510 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18510
Vulnerability Analysis
The vulnerability is a stored XSS issue tracked under [CWE-79]. TranslatePress renders comment content through its translation pipeline in class-translation-render.php. The rendering logic interprets gettext markers embedded within comment strings and inserts translated output into the DOM without sufficient escaping. Because the payload restricts itself to tags and attributes that wp_kses normally accepts, and encodes malicious characters as percent-encoded sequences inside URL attributes, the sanitizer passes the input unchanged. When the plugin later decodes these sequences during translation rendering, the resulting HTML contains executable script context.
Root Cause
The root cause is insufficient input sanitization combined with improper output escaping during translation rendering. WordPress wp_kses validates URL attributes against an allowlist but does not decode percent-encoded characters before evaluation. TranslatePress subsequently processes these values as gettext markers, expanding them into HTML that carries attacker-controlled content into rendered pages. The relevant code paths reside at lines 1232, 1314, and 1575 of class-translation-render.php in version 3.2.6.
Attack Vector
An unauthenticated remote attacker submits a comment containing URL-encoded gettext markers with a crafted payload. First-time comments enter moderation, but the payload survives approval because it uses only permitted markup. Once the comment is displayed, TranslatePress decodes and renders the injected content, executing attacker-supplied JavaScript in the context of the site for every visitor of the affected page. Verified technical details are available in the Wordfence advisory.
Detection Methods for CVE-2026-18510
Indicators of Compromise
- Comment records in the WordPress database containing percent-encoded sequences inside URL attributes, particularly within href or src values wrapped in gettext markers.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that render approved comments.
- Presence of gettext delimiter patterns embedded inside submitted comment content that decode into script-bearing HTML.
Detection Strategies
- Inspect the wp_comments table for entries containing suspicious percent-encoded payloads and gettext marker syntax.
- Correlate web server access logs with anomalous POST requests to wp-comments-post.php that carry encoded HTML entities.
- Review page responses served by the TranslatePress translation renderer for decoded script fragments not present in original comment text.
Monitoring Recommendations
- Alert on WordPress installations running the TranslatePress plugin at version 3.2.6 or earlier.
- Monitor comment submissions from unauthenticated visitors for high-entropy or URL-encoded payloads.
- Track browser-side Content Security Policy (CSP) violation reports from pages that display comments.
How to Mitigate CVE-2026-18510
Immediate Actions Required
- Update the TranslatePress – Translate Multilingual plugin to version 3.3 or later on all WordPress sites.
- Audit existing approved comments for URL-encoded gettext markers and remove any suspicious entries before further rendering.
- Rotate administrator sessions and credentials if evidence of script execution is observed in logs.
Patch Information
The vendor addressed the issue in TranslatePress version 3.3. The fix is delivered in WordPress plugin changeset #3634273. A full diff between the vulnerable and patched releases is available in the 3.2.6 to 3.3 changeset comparison.
Workarounds
- Disable the TranslatePress plugin until the update to version 3.3 can be applied.
- Require manual moderation for all comments and reject submissions containing percent-encoded characters inside URL attributes.
- Deploy a restrictive Content Security Policy that blocks inline scripts and unauthorized script sources on pages rendered by the plugin.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
