TranslatePress marker replacement bypasses search escaping for reflected XSS
TranslatePress through 3.2.5 processes the public s search parameter through normal WordPress escaping, but translate_page() later replaces the plugin's #!trpst# and #!trpen# marker tokens with literal angle brackets across the completed HTML response. Because those tokens are not HTML special characters when the search value is escaped, an unauthenticated attacker can use them to reconstruct executable markup after escaping and run JavaScript when a victim follows a crafted search link. The CNA does not disclose a more specific route or final output function.
- Component
- TranslatePress – Translate Multilingual sites with AI Translation
- Plugin slug
translatepress-multilingual- Affected
- <= 3.2.5
- Safe version
> 3.2.5- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 5 known issues for this plugin.
Update, patch or deactivate.
Update TranslatePress to a release after 3.2.5. The authoritative record links a trunk correction but does not identify the first fixed release. Avoid untrusted search links containing TranslatePress marker tokens until updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input — allowing the attacker to bypass WordPress's normal HTML escaping by using these tokens, which are not HTML special characters, in the search query. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N