TranslatePress

TranslatePress through 3.2.5 unconditionally converts the plain-text gettext markers #!trpst# and #!trpen# into < and > in translate_page(). An unauthenticated attacker can place those markers around an image element in a comment; the marker text survives wp_kses, then becomes a real HTML tag when the post is rendered in a secondary language. Because remove_tags_from_output() removes script and style elements but not an image event handler, the resulting payload executes in each visitor's browser.

TranslatePress through 3.2.6 allows an unauthenticated commenter to store URL-encoded gettext markers in comment content. The encoded marker text survives WordPress HTML filtering, and remove_trp_html_tags() uses an unbounded capture that can span raw quote and tag delimiters between otherwise permitted attributes. When TranslatePress renders the translated page, those delimiters can be spliced into an executable attribute and run script in a visitor's WordPress origin. First-time-commenter moderation may delay display but does not neutralize an accepted payload. The CNA does not disclose the complete payload, exact translation configuration or public exploitation.

TranslatePress through 3.2.5 processes the public s search parameter through normal WordPress escaping, but translate_page() later replaces the plugin's #!trpst# and #!trpen# marker tokens with literal angle brackets across the completed HTML response. Because those tokens are not HTML special characters when the search value is escaped, an unauthenticated attacker can use them to reconstruct executable markup after escaping and run JavaScript when a victim follows a crafted search link. The CNA does not disclose a more specific route or final output function.

TranslatePress is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

TranslatePress is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.

TranslatePress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.