Now officially on WordPress.org

CVE Database / CVE-2026-17505

CVE · Medium

CVE-2026-17505 — TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.2.6

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-17505 TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.2.6 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 3.2.6 3.2.6 2026-08-04 —

CVE-2026-17505

The TranslatePress plugin for WordPress contains a security flaw affecting versions up to 3.2.5, where the translate_page function fails to properly sanitize input from the 's' parameter. This oversight allows malicious actors to inject HTML code into pages by exploiting the plugin's internal marker tokens, which are not treated as special characters in HTML. As a result, attackers can execute arbitrary scripts on vulnerable sites without requiring authentication.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings