Now officially on WordPress.org

CVE Database / CVE-2026-18510

CVE · High

CVE-2026-18510 — TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.3

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-18510 TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') High 7.2 < 3.3 3.3 2026-08-04 —

CVE-2026-18510

A vulnerability exists in TranslatePress plugin versions up to 3.2.6, allowing attackers to inject malicious scripts into pages through comment content. This is due to inadequate filtering of input data and insufficient protection against web script injection. As a result, an attacker can execute arbitrary code on the affected site, even without authentication.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings