{"apiVersion":"1.0","identifier":"CVE-2026-75981","description":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers -#!trpst#- and -#!trpen#- are unconditionally rewritten to -<- and ->- by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker-s -#!trpst#img ... #!trpen#- into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor-s browser.","publishedAt":"2026-08-19T07:16:59","lastModifiedAt":"2026-08-20T12:48:10","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75981","cvssScore":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","epssProbability":0.00245,"riskScore":0.74,"affectedProduct":"translatepress-multilingual","affectedVersions":"<=3.2.5","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-75981","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-75981","en":"https://www.redsauce.net/en/cves/CVE-2026-75981","fr":"https://www.redsauce.net/fr/cves/CVE-2026-75981","pt":"https://www.redsauce.net/pt/cves/CVE-2026-75981","de":"https://www.redsauce.net/de/cves/CVE-2026-75981","sk":"https://www.redsauce.net/sk/cves/CVE-2026-75981","el":"https://www.redsauce.net/el/cves/CVE-2026-75981"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-75981"}}