CVE-2026-76053 Overview
CVE-2026-76053 is a stored Cross-Site Scripting (XSS) vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress. The flaw affects all plugin versions up to and including 3.3.3. The vulnerability stems from insufficient input sanitization and output escaping when the plugin processes translated content through its HTML parser. Unauthenticated attackers can inject arbitrary JavaScript into pages by abusing WordPress's comment KSES allowlist, which permits anchor tags with href and title attributes alongside code tags. The malicious payload is stored in the database and executed later when users view the translated page. The vulnerability is classified under [CWE-79].
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into translated WordPress pages, enabling session hijacking, credential theft, and drive-by attacks against every visitor.
Affected Products
- TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress
- All versions up to and including 3.3.3
- Fixed in version 3.3.4
Discovery Timeline
- 2026-08-28 - CVE-2026-76053 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-76053
Vulnerability Analysis
The vulnerability lives in TranslatePress's translation rendering pipeline, which relies on a bundled SimpleHTMLDOM parser located at assets/lib/simplehtmldom/simple_html_dom.php. When the plugin processes a page for translation, it parses page content through this DOM library and later re-emits translated fragments via class-translation-render.php. Attackers craft WordPress comments that pass through the default KSES allowlist because the payload uses permitted elements: an anchor tag with href and title attributes wrapped around a code tag. Because KSES accepts the structure as benign, the raw payload is written verbatim into the database.
When TranslatePress later parses that stored comment, the SimpleHTMLDOM parser misinterprets the encoded noise-key structure and reconstructs it into executable HTML during rendering. The result is stored JavaScript execution in the browser of any visitor loading the translated page.
Root Cause
The root cause is a mismatch between WordPress's KSES sanitization model and TranslatePress's downstream HTML parser. KSES validates on element and attribute names only, while the SimpleHTMLDOM tokenizer treats certain nested comment-key structures as parseable HTML during translation rendering. The vulnerable code paths sit at simple_html_dom.php lines 497, 1549, 2125, and 2220, and at class-translation-render.php lines 664 and 1226.
Attack Vector
An unauthenticated attacker submits a comment to any post on a WordPress site running the plugin. The comment body contains an anchor element carrying scriptable payload data inside title and href attributes alongside a code child. When a visitor loads the translated version of the page, the injected script executes in that visitor's browser session, inheriting the site's origin.
No verified public exploit code is available. Detailed technical references are provided in the Wordfence Vulnerability Report and the WordPress Changeset 3665013.
Detection Methods for CVE-2026-76053
Indicators of Compromise
- Comments in wp_comments containing nested anchor tags with href and title attributes wrapping <code> elements and JavaScript-like payloads.
- Outbound requests from visitor browsers to unfamiliar domains initiated when loading translated pages.
- Unexpected script executions or DOM modifications on multilingual page variants served by TranslatePress.
Detection Strategies
- Audit the WordPress comments table for payloads matching regex patterns targeting title="...on\w+=..." or JavaScript URI schemes inside anchor attributes.
- Inspect rendered HTML of translated URLs for <script> elements that do not appear in the source post content.
- Compare the TranslatePress plugin version reported in wp-content/plugins/translatepress-multilingual/ against the fixed release 3.3.4.
Monitoring Recommendations
- Enable web application firewall rules that inspect comment submissions for HTML event handler attributes.
- Log and alert on new administrator sessions created shortly after visits to translated pages.
- Monitor plugin file integrity for simple_html_dom.php and class-translation-render.php to detect tampering or reintroduction of vulnerable code.
How to Mitigate CVE-2026-76053
Immediate Actions Required
- Update the TranslatePress plugin to version 3.3.4 or later on every affected WordPress installation.
- Purge any cached translated pages to remove stored malicious payloads from CDN and page caches.
- Review the wp_comments table and delete or sanitize comments containing suspicious anchor and code tag combinations.
Patch Information
The vendor addressed the flaw in TranslatePress 3.3.4. The fix is captured in the WordPress Changeset from 3.3.3 to 3.3.4 and the parser hardening commit in WordPress Changeset 3665013. Administrators should apply the update through the WordPress plugin manager or WP-CLI.
Workarounds
- Temporarily disable public comment submission on posts served by TranslatePress until the plugin is upgraded.
- Restrict comment HTML by removing anchor title attribute permissions via a custom wp_kses_allowed_html filter.
- Place the site behind a WAF configured to block HTML event handler patterns and JavaScript URI schemes in unauthenticated POST bodies.
# Configuration example
wp plugin update translatepress-multilingual --version=3.3.4
wp cache flush
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
