CVE-2026-120537 · Package
NO FIX YET · SEE WHAT TO DO
The TranslatePress WordPress plugin stores attacker-supplied input from its translation endpoint without sanitizing or escaping it, in all versions up to and including 3.3.8. An unauthenticated attacker can inject scripts into pages that run in the browser of any visitor who opens the injected page.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any WordPress site running TranslatePress version 3.3.8 or earlier is exposed, because the flaw is reachable without an account. Sites that do not run this plugin can skip it. The sources do not say whether specific settings change exposure.
Not affected if plugin-not-installed
Who cares self-hosted, translatepress, wordpress
translatepress-multilingual/translatepress-multilingual.php3.3.8 or earlier3.3.8; the exact fixed version is unknown from the sourcesThe TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (storage); originals / language / original_language (exfiltration from endpoint)' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.