We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

TranslatePress – Translate Multilingual sites with AI Translation Plugin Vulnerability (CVE-2026-89412)

Nick Paliughi
On this page

Security Alert Summary

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the Translation Memory Suggestion Panel. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject executable scripts into the translation memory that are later rendered in administrative or other users’ sessions when an affected page is viewed.

CVE Details

  • CVE ID: CVE-2026-89412
  • Affected component: TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress
  • Affected versions: All versions up to and including 3.3.5
  • Published: September 22, 2026 at 07:16:29 AM UTC
  • Last modified: September 22, 2026 at 07:16:29 AM UTC
  • CVSS v3.1: Base Score 7.2, Severity HIGH, Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  • Authentication / Privileges / User interaction: Authentication not required; Privileges required: NONE; User interaction: NONE; Attack vector: NETWORK; Attack complexity: LOW; Scope: CHANGED
  • Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
  • Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)

Technical Details

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the plugin’s Translation Memory Suggestion Panel. The plugin renders suggestion.original using a v-html binding, and the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence. The translation memory’s original column is deliberately exempt from kses filtering, so no save-time sanitizer neutralizes a stored payload before it is later rendered.

As a result, an unauthenticated attacker can insert executable HTML or script into the translation dictionary’s original column. Because the saved value is later rendered into pages with v-html without adequate escaping or filtering, the stored payload can execute in the context of users who view the affected page, including administrators.

The provided references point to the translation-memory and translation-render implementation files where the rendering and storage behavior occur, illustrating the rendering path and the absence of kses filtering on the original column.

How This Could Impact Your Website

Consider a realistic scenario: a site owner manages content and several internal staff members edit translations, while external contributors or contractors submit translation suggestions. An unauthenticated attacker could seed the translation memory so that when an editor or administrator reviews or visits an affected page, the injected script executes in their browser. Practical consequences include:

  • Exposure of information available in the user interface, such as internal user display names or other content accessible to the viewing account.
  • Increased risk of targeted phishing or social engineering against privileged users if the attacker harvests email addresses or session-visible data.
  • Unwanted script execution in administrator or editor sessions that may be used to perform actions limited by the viewing user’s privileges in the browser context.

If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles and privileges, especially contributor-level accounts and unauthenticated submission paths.
  • Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
  • Remove unused or unmaintained plugins and disable front-end submission endpoints that are not required.
  • Monitor site activity and logs for unusual behavior, especially administrative sessions and unexpected changes in translation entries.

If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
PixelPlay Plugin Vulnerability (CVE-2025-14486)
Next Post
BM Content Builder Plugin Vulnerability (CVE-2025-1281)