CVE-2026-75981: TranslatePress WordPress XSS Vulnerability

CVE-2026-75981 Overview

CVE-2026-75981 is an unauthenticated stored cross-site scripting (XSS) vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress. The flaw affects all versions up to and including 3.2.5. The plugin unconditionally rewrites the gettext marker tokens #!trpst# and #!trpen# into < and > after WordPress sanitization runs. An unauthenticated attacker can submit a comment containing these tokens, bypass wp_kses, and inject arbitrary HTML that executes in a visitor's browser when the page is rendered in a secondary language. The issue is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into any WordPress site running TranslatePress ≤ 3.2.5 by submitting a crafted comment, enabling session theft, admin account takeover, and drive-by redirection of visitors browsing translated pages.

Affected Products

TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress
All versions up to and including 3.2.5
WordPress sites serving content in one or more secondary (translated) languages

Discovery Timeline

2026-08-19 - CVE-2026-75981 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75981

Vulnerability Analysis

The vulnerability lives in the translate_page() function inside includes/class-translation-render.php at lines 538-539. TranslatePress uses the sentinel strings #!trpst# and #!trpen# internally to mark the start and end of translatable HTML tags before gettext processing. After translation runs, the plugin replaces these markers with < and > to reconstruct the original HTML.

Because the tokens contain only alphanumeric characters and #! symbols, they are not treated as HTML by wp_kses or by WordPress core comment sanitization. Any attacker-controlled input containing the markers passes filtering intact. When the stored comment is later rendered on a page served in a secondary language, TranslatePress rewrites the tokens into angle brackets, producing live HTML tags in the output.

The secondary filter remove_tags_from_output() only strips <script> and <style> elements. Tag attributes carrying JavaScript event handlers such as onerror, onload, or onmouseover are not removed, so payloads like an <img> tag with an onerror handler execute in the visitor's browser context.

Root Cause

The root cause is trust misplacement in the input pipeline. TranslatePress performs its token-to-bracket substitution after WordPress sanitization instead of before it. The reconstruction step should occur only on trusted, plugin-generated strings, not on arbitrary user input flowing through comments, post meta, or other stored surfaces.

Attack Vector

An unauthenticated attacker submits a comment containing a payload such as #!trpst#img src=x onerror=alert(document.cookie) #!trpen#. WordPress stores the comment as plain text because it contains no HTML-special characters. When any visitor requests the associated post in a translated language, translate_page() rewrites the markers into <img src=x onerror=alert(document.cookie) > and the browser executes the injected JavaScript. Full details are documented in the Wordfence Vulnerability Report and the vulnerable code is visible in the WordPress Plugin Code Reference.

Detection Methods for CVE-2026-75981

Indicators of Compromise

Comments, post content, or user-supplied fields in the WordPress database containing the literal strings #!trpst# or #!trpen#.
Outbound requests from visitor browsers to unfamiliar domains immediately after loading a translated page.
New administrator accounts or unexpected changes to the wp_users table following visits from privileged users to translated content.
Unexpected <img>, <iframe>, or <svg> tags appearing in rendered secondary-language pages that are absent from the primary-language source.

Detection Strategies

Query the wp_comments and wp_posts tables for occurrences of #!trpst# or #!trpen# using SELECT statements against comment_content and post_content.
Deploy web application firewall rules that block HTTP request bodies containing these marker tokens on comment submission endpoints.
Monitor rendered page responses for injected event-handler attributes such as onerror=, onload=, or onmouseover= that were not present in the original post.

Monitoring Recommendations

Enable full request logging for wp-comments-post.php and REST comment endpoints to capture attacker payloads for retrospective analysis.
Alert on browser-reported Content Security Policy (CSP) violations originating from translated URLs.
Correlate administrator session activity with visits to translated pages to identify potential session hijacking chains.

How to Mitigate CVE-2026-75981

Immediate Actions Required

Update the TranslatePress plugin to a version newer than 3.2.5 as soon as the vendor releases a patched release.
Audit wp_comments, wp_posts, and any custom tables for stored payloads containing #!trpst# or #!trpen# and remove or neutralize matching rows.
Rotate credentials and session tokens for administrator accounts that may have viewed translated pages while the vulnerability was exposed.

Patch Information

At the time of NVD publication, all versions of TranslatePress up to and including 3.2.5 are affected. Consult the Wordfence Vulnerability Report and the plugin changelog on WordPress.org for the fixed release version once available. The vulnerable code paths at line 538 and line 539 must be replaced with logic that performs marker substitution only on trusted plugin output.

Workarounds

Disable public comments site-wide or on posts that are available in translated languages until the plugin is patched.
Deploy a WAF rule that rejects any HTTP request whose body contains #!trpst# or #!trpen# and returns HTTP 403.
Temporarily deactivate the TranslatePress plugin on production sites that cannot restrict comment submissions.
Enforce a strict Content Security Policy that disallows inline event handlers to blunt payload execution even if injection succeeds.

bash

# Search the WordPress database for stored payloads
wp db query "SELECT comment_ID, comment_author, comment_post_ID \
  FROM wp_comments \
  WHERE comment_content LIKE '%#!trpst#%' \
     OR comment_content LIKE '%#!trpen#%';"

# Example ModSecurity rule to block the markers on comment submission
SecRule REQUEST_URI "@rx /wp-comments-post\.php" \
  "chain,id:1002601,phase:2,deny,status:403,\
   msg:'CVE-2026-75981 TranslatePress XSS marker blocked'"
  SecRule REQUEST_BODY "@rx #!trp(st|en)#" "t:none"