CyberRota Analysis
AI-GeneratedThe TranslatePress plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting, allowing attackers to inject malicious scripts through specially crafted comments. This vulnerability can lead to the execution of arbitrary code in the context of a user's browser, potentially compromising user data and site integrity. WordPress site administrators using versions up to 3.2.5 should prioritize patching this issue to mitigate the risk of exploitation.
Original NVD Description
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.