Now officially on WordPress.org

CVE Database / CVE-2026-75981

CVE · High

CVE-2026-75981 — TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.2.6

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-75981 TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual] < 3.2.6 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') High 7.2 < 3.2.6 3.2.6 2026-08-05 —

CVE-2026-75981

The TranslatePress plugin for WordPress contains a vulnerability in versions up to 3.2.5 that allows an attacker to inject malicious JavaScript code without needing to authenticate. This is possible because the plugin fails to properly sanitize certain gettext markers, which can be embedded in comments and later executed as HTML when the page is viewed in a secondary language. As a result, an attacker can inject an image tag with an "onerror" attribute that executes malicious code in the visitor's browser.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings