CVE-2026-120537

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.8 . The root cause is insufficient input sanitization and output escaping associated with the 'comment (storage); o...

CVE-2026-120537 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment storage; originals / language / originallanguage exfiltration from endpoint' parameter in all versions up to, and including, 3.3.8 due to...