Cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation

• CVE-2026-120537 High 7.2 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint –
• CVE-2026-119167 High 7.2 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass –
• CVE-2026-107768 High 7.2 TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers 0.3%
• CVE-2026-89412 High 7.2 TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel 0.5%
• CVE-2026-76053 High 7.2 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser 0.8%
• CVE-2026-19632 Critical 9.8 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure 4.5%
• CVE-2026-18512 Medium 6.4 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor 0.4%
• CVE-2026-75981 High 7.2 TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting 0.4%
• CVE-2026-18510 High 7.2 TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content 0.4%
• CVE-2026-17505 Medium 6.1 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting 0.9%