Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-75981 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up… https://www.cve.org/CVERecord?id=CVE-2026-75981
Post summary
The content announces CVE-2026-75981, describing a stored XSS vulnerability in TranslatePress, with no mention of PoC, exploit, or patch.
CVE-2026-75981 Unauthenticated Stored XSS in TranslatePress Plugin Up To 3.2.5 Via Special Markers https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-75981
Post summary
The entry announces an unauthenticated stored XSS vulnerability (CVE‑2026‑75981) affecting TranslatePress plugin versions up to 3.2.5, with further details available at the provided vulmon link.
🚨*CVE* CVE-2026-75981 The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up… https://www.cve.org/CVERecord?id=CVE-2026-75981 ----- Traducción: CVE-2026-75981 El … https://infoflow.cloud`
Post summary
The post announces CVE‑2026‑75981, detailing an unauthenticated stored XSS vulnerability in the TranslatePress WordPress plugin, with no PoC, exploit code, active exploitation, patch, or false‑positive claim mentioned.