CVE-2026-18510 cozmoslabs CVE debrief

Who should care

WordPress site administrators and users who have the TranslatePress plugin installed should be aware of this vulnerability and take necessary precautions to prevent potential XSS attacks. This includes updating the TranslatePress plugin to a version beyond 3.2.6 and implementing additional security measures such as Content Security Policy (CSP) and regular security audits. Site administrators should also educate users about the risks of XSS attacks and monitor comment sections for suspicious activity.

Technical summary

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6. This is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability affects WordPress site administrators and users who have the TranslatePress plugin installed.

Defensive priority

WordPress site administrators and users should prioritize updating the TranslatePress plugin to prevent potential XSS attacks.

Recommended defensive actions

• Update the TranslatePress plugin to a version beyond 3.2.6.
• Implement additional security measures such as Content Security Policy (CSP) and regular security audits.
• Monitor comment sections for suspicious activity.
• Educate users about the risks of XSS attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified. Defenders should verify affected versions, review comment sections for suspicious activity, and monitor for potential exploitation attempts.

Official resources