WordPress TranslatePress < 3.2.6 - Cross-Site Scripting

TranslatePress plugin 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges. id: CVE-2026-17505 info: name: WordPres...

Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...

WordPress Core <=6.2 - Directory Traversal

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wplang’ parameter. id: CVE-2023-2745 info: name: WordPress Core =6.2 - Directory Traversal author: nqdung2002 severity: medium description: | WordPress Core is vulnerable to Directory Traversal in...

NPM: gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

NPM: gettext-converter: Prototype pollution in js2i18next via crafted translation keys vulnerability discovered by ? in WordPress Npm gettext-converter versions 1.3.3...

GHSA-F4JP-RW7W-CCWG gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

Wagtail: Improper restriction handling on Page translation API endpoint

Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...

EUVD-2026-41149

Wagtail: Pages translations can be created without page permissions when using simpletranslation...

CVE-2026-75981

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

EUVD-2026-62343

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

CVE-2026-65832 Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons...

CVE-2026-65832 Deskflow - Unauthenticated server-controlled out-of-bounds read in ServerProxy::setOptions / translateKey modifier-table indexing

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons...

PT-2026-72466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the gue...

CVE-2026-44741

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-44741

Summary of CVE-2026-44741 / GHSA-h4ph-crvj-9h92: The Pimcore Admin Classic Bundle contains a SQL injection in the translation grid date filter where the user-supplied property field is interpolated into a SQL expression (UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))) without parameterization. Affected...

EUVD-2026-57357

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...

CVE-2026-73212

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr in src/server/nsturnserver.c uses ioaaddrinrange in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 T...

CVE-2026-56179 Windows Network Address Translation (NAT) Spoofing Vulnerability

...

WordPress Ray Enterprise Translation plugin <= 1.7.3 - Subscriber+ Language Addition and Deletion vulnerability

Subscriber+ Language Addition and Deletion vulnerability discovered by Akshat Parikh in WordPress Plugin Ray Enterprise Translation versions = 1.7.3...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...