https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:48:18 +0000 https://vulnerability.circl.lu/vuln/cve-2026-75981 <p><strong>Affected:</strong> cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation</p> <p>The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers &#39;#!trpst#&#39; and &#39;#!trpen#&#39; are unconditionally rewritten to &#39;&lt;&#39; and &#39;&gt;&#39; by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker&#39;s &#39;#!trpst#img ... #!trpen#&#39; into a real &lt;img&gt; tag. remove_tags_from_output() only strips &lt;script&gt;/&lt;style&gt;, so an &lt;img onerror=...&gt; executes in the visitor&#39;s browser.</p> <p><strong>Affected:</strong> cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation</p> <p>The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers &#39;#!trpst#&#39; and &#39;#!trpen#&#39; are unconditionally rewritten to &#39;&lt;&#39; and &#39;&gt;&#39; by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker&#39;s &#39;#!trpst#img ... #!trpen#&#39; into a real &lt;img&gt; tag. remove_tags_from_output() only strips &lt;script&gt;/&lt;style&gt;, so an &lt;img onerror=...&gt; executes in the visitor&#39;s browser.</p> https://vulnerability.circl.lu/vuln/cve-2026-75981