{"id":"CVE-2026-121765","kind":"vulnerability","aliases":["CVE-2026-121765"],"related":[],"title":"TranslatePress WordPress plugin: stored XSS through version 3.3.8","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.8.","summary":"TranslatePress, a WordPress translation plugin by Cozmoslabs, contains a stored cross-site scripting flaw in versions up to and including 3.3.8. An attacker who can get script into a page can have it run in other visitors' browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","translatepress","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed TranslatePress version in the WordPress admin plugin list or `wp plugin get translatepress-multilingual --field=version`\n- Compare the installed version against 3.3.8 and anything above it","fix":"- Versions through `3.3.8` are affected; the sources do not name a fixed version","status":"open","published_at":"2026-11-07T12:17:45+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","triaged_at":"2026-11-07T12:48:57+00:00","updated_at":"2026-11-07T12:48:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T12:48:57Z","model":"claude-haiku-5-5","output":{"fix":"- Versions through `3.3.8` are affected; the sources do not name a fixed version","reach":"internet","title":"TranslatePress WordPress plugin: stored XSS through version 3.3.8","impact":"medium","summary":"TranslatePress, a WordPress translation plugin by Cozmoslabs, contains a stored cross-site scripting flaw in versions up to and including 3.3.8. An attacker who can get script into a page can have it run in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","translatepress","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, possibly admin sessions","analyst_note":"Find the fixed version and the vulnerable input path or required role from the NVD entry or the Cozmoslabs/Wordfence advisory.","how_to_check":"- Check the installed TranslatePress version in the WordPress admin plugin list or `wp plugin get translatepress-multilingual --field=version`\n- Compare the installed version against 3.3.8 and anything above it","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the TranslatePress multilingual plugin at version 3.3.8 or earlier are in scope. The sources do not say which input path or user role is needed to store the script, so the exposure of any given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000702,"input_tokens":4226,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121765':11A,14A '-2026':10A,13A '3.3.8':8A,42B,88C 'affect':83C 'allow':79C 'attack':44B 'browser':59B 'contain':28B 'cozmoslab':27B,74C 'cross':32B,69C 'cross-sit':31B,68C 'cve':9A,12A 'flaw':35B 'generat':67C 'get':47B 'host':18B 'improp':60C 'includ':41B 'input':63C 'issu':82C 'multilingu':78C 'n/a':86C 'neutral':61C 'packag':15B 'page':51B,66C 'plugin':3A,25B 'run':55B 'script':34B,48B,71C 'self':17B 'self-host':16B 'site':33B,70C 'store':4A,30B,80C 'translat':24B 'translatepress':1A,19B,21B,75C,77C,84C 'translatepress-multilingu':76C 'version':7A,37B 'visitor':58B 'vulner':72C 'web':65C 'wordpress':2A,20B,23B 'xss':5A 'xss.this':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running the TranslatePress multilingual plugin at version 3.3.8 or earlier are in scope. The sources do not say which input path or user role is needed to store the script, so the exposure of any given site is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","translatepress","wordpress"],"campaign_type":null,"search_a":"'-121765':11A,14A '-2026':10A,13A '3.3.8':8A 'cve':9A,12A 'plugin':3A 'store':4A 'translatepress':1A 'version':7A 'wordpress':2A 'xss':5A","search_b":"'3.3.8':42B 'attack':44B 'browser':59B 'contain':28B 'cozmoslab':27B 'cross':32B 'cross-sit':31B 'flaw':35B 'get':47B 'host':18B 'includ':41B 'packag':15B 'page':51B 'plugin':25B 'run':55B 'script':34B,48B 'self':17B 'self-host':16B 'site':33B 'store':30B 'translat':24B 'translatepress':19B,21B 'version':37B 'visitor':58B 'wordpress':20B,23B","search_c":"'3.3.8':88C 'affect':83C 'allow':79C 'cozmoslab':74C 'cross':69C 'cross-sit':68C 'generat':67C 'improp':60C 'input':63C 'issu':82C 'multilingu':78C 'n/a':86C 'neutral':61C 'page':66C 'script':71C 'site':70C 'store':80C 'translatepress':75C,77C,84C 'translatepress-multilingu':76C 'vulner':72C 'web':65C 'xss.this':81C","first_public_at":"2026-11-07T12:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121765","severity":null,"published_at":"2026-11-07T12:17:45+00:00","modified_at":"2026-11-07T12:17:45+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","fetched_at":"2026-11-07T12:47:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}