CVE-2026-18510

Executive Summary

CVE-2026-18510 is an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the TranslatePress plugin for WordPress, affecting all versions up to and including 3.2.6. The flaw resides in the plugin's handling of comment content that contains URL-encoded gettext markers, which bypasses WordPress's built-in sanitization (wp_kses) due to insufficient input sanitization and output escaping. Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into page content, which execute whenever any user (including administrators) views the affected page. The vulnerability carries a CVSS score of 7.2 (High) and requires no authentication or user interaction, making it remotely exploitable against any WordPress site running the affected plugin.

Technical Analysis

The vulnerability is rooted in TranslatePress's translation workflow, which relies on gettext markers to identify translatable strings within page content. These markers are typically formatted as <!-- wp:paragraph --> style comments or #!trpst# / #!trpstg# marker tags embedded in the HTML. The plugin processes comment content (user-generated submissions via WordPress's comment system) through its translation pipeline, expecting to find these markers to extract and translate text.

The core flaw is a double-decoding and sanitization bypass:

1. Insufficient Input Sanitization: When a user submits a comment containing gettext markers that have been percent-encoded (e.g., %23!trpst%23 instead of #!trpst#), TranslatePress decodes these markers as part of its translation processing. However, the plugin performs this decoding after WordPress's wp_kses function has already validated the comment content.

2. wp_kses Bypass: WordPress's wp_kses is designed to strip disallowed HTML tags and attributes. The NVD description explicitly states that the payload uses "only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified." This means an attacker can craft a payload using benign tags like <a>, <img>, or <svg>, with attributes that pass the initial sanitization check. The dangerous content (JavaScript event handlers) is hidden within percent-encoded gettext markers that wp_kses does not recognize as dangerous because they appear as URL-encoded data in allowed attributes.

3. Output Escaping Failure: When the comment is later rendered on the page, TranslatePress's rendering engine processes the gettext markers again for translation lookup. During this second pass, the percent-encoded characters are decoded, and the previously sanitized "safe" attributes are transformed into executable JavaScript (e.g., an onerror or onload handler injected into an <img> tag). The plugin fails to re-escape this output, allowing the script to execute in the victim's browser.

4. Comment Moderation Limitation: The NVD description notes that comment moderation "may delay exploitation for first-time commenters, but does not prevent it." This is because WordPress typically holds comments from new users in a moderation queue. However, the payload "uses only WordPress-permitted tags and attributes," meaning it does not trigger WordPress's spam filters or moderation flags when submitted — it passes the initial checks and appears to be benign content. Once approved (or if the commenter has previous approved comments, bypassing moderation entirely), the malicious script persists.

The attack surface is the WordPress comment system, which is inherently unauthenticated (any visitor can post a comment). The plugin's translation pipeline adds a second processing layer that is not protected by the same sanitization standards as the core WordPress comment handling.

Affected Configuration: Any WordPress installation with TranslatePress ≤ 3.2.6 active, comments enabled on posts/pages, and guests allowed to comment.

Exploitation Scenarios

Attack Chain — Unauthenticated Stored XSS via Comment Injection:

Step 1: Reconnaissance and Target Identification The attacker identifies WordPress sites running TranslatePress ≤ 3.2.6. This can be done by:

• Scanning for the plugin's distinctive HTML markers (e.g., trp-edit-translation in the page source) or language switcher.
• Using Shodan/Censys queries to find sites with TranslatePress-specific headers or cookies.
• Checking WordPress plugin directory for version fingerprinting (e.g., reading the plugin's readme.txt if not hardened).

Step 2: Crafting the Malicious Comment Payload The attacker crafts a comment containing a payload that triggers XSS upon translation rendering. A representative payload structure:

<a href="https://example.com/%23!trpst%23%3Cimg%20src=x%20onerror=alert(document.cookie)%3E%23!trpstg%23">Click here</a>

Breaking this down:

• %23!trpst%23 — URL-encoded gettext marker open tag (#!trpst#).
• %3Cimg%20src=x%20onerror=alert(document.cookie)%3E — URL-encoded inline <img src=x onerror=alert(document.cookie)> script.
• %23!trpstg%23 — URL-encoded gettext marker close tag (#!trpstg#).

When wp_kses validates this, it sees an <a> tag with an href attribute containing what appears to be a valid URL. The percent-encoded characters inside the URL are not flagged. The comment is stored in the database.

Step 3: Triggering the Decoding and Execution When a user (victim) loads the page containing the comment, TranslatePress processes the content to extract translatable strings. The plugin decodes the percent-encoded gettext markers and, in doing so, introduces the decoded <img> tag into the page's HTML. Because the plugin does not re-escape this output, the browser renders the injected <img> tag, which fires the onerror handler. The attacker's JavaScript executes in the context of the victim's session.

Alternative payload variants use <svg onload>, <iframe src=javascript:>, or other event-handler-based injection techniques, all disguised within the gettext markers.

Step 4: Post-Exploitation Impact

• Session Hijacking: The injected script can capture document.cookie, sending it to an attacker-controlled server.
• Privilege Escalation: If an administrator views the page, the script can create a new admin user, modify site content, or install backdoor plugins.
• Lateral Movement: Stolen admin credentials or session tokens can be used to further compromise the hosting server via plugin/theme file upload (which requires admin access).
• SEO Poisoning: Injection of hidden links or redirects to spam/malware sites, damaging the site's reputation and SEO ranking.

Moderation Bypass Note: If the site has comment moderation enabled for new users, the comment will sit in the queue. However, the payload is designed to pass wp_kses and spam filters, so moderators see a benign-looking link. Once approved, the XSS triggers. Attackers can also pre-authenticate by posting legitimate-looking comments (using the same payload but benign URLs) before the attack, building a comment history that bypasses moderation (WordPress auto-approves comments from users with previously approved comments).

Impact Assessment

• CVSS Breakdown: The vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates: Network attack vector (remotely exploitable), Low attack complexity (no special conditions), No privileges required (unauthenticated), No user interaction required (automatic execution on page load), Scope change (impact extends beyond the vulnerable component to the underlying web app/session), Low Confidentiality impact (data theft), Low Integrity impact (content modification), No Availability impact.
• Business Impact:
  • Data Breach Risk: Session tokens, cookies, and potentially sensitive form data visible to the attacker.
  • Account Takeover: Administrator accounts are the highest-value target; full site compromise is possible.
  • Reputational Damage: Defacement or malicious redirects harm public trust.
  • Regulatory: If the compromised site handles PII (GDPR, HIPAA, etc.), a data breach triggers notification obligations.
• Affected Systems: WordPress sites with TranslatePress ≤ 3.2.6. Since TranslatePress is a multilingual plugin, sites catering to international audiences with comment sections enabled are highest risk. Given the plugin's popularity, the potential blast radius is significant.
• Exploitation Maturity: While no public PoC code exists, the vulnerability class (Stored XSS in WordPress comment handling) is well-understood and routinely exploited. The low EPSS percentile (15.5%) suggests it is not currently being mass-exploited, but the attack vector is trivial to replicate once a researcher publishes their findings.

Detection Guidance

Sigma Rule

title: Potential TranslatePress Stored XSS via Percent-Encoded gettext Markers
id: 5f4b9a4c-5f6d-4e7b-9d1e-3a7e1a9c0f30
status: experimental
description: Detects comment submissions or page responses containing percent-encoded TranslatePress gettext markers (#!trpst#) combined with HTML event handler attributes.
logsource:
    category: webserver
    product: generic
detection:
    selection_uri:
        http.uri|contains|all:
            - '%23%21trpst%23'
            - 'onload='
            - 'onerror='
    selection_body:
        http.body|contains|all:
            - '#!trpst#'
            - 'onerror='
            - 'onload='
    condition: selection_uri or selection_body
level: high
falsepositives:
    - Legitimate URLs containing encoded gettext parameters (rare)
tags:
    - attack.t1190
    - cve.2026.18510

YARA Rule

rule TranslatePress_Stored_XSS_Gettext_Bypass
{
    meta:
        author = "Valter Sec Threat Intel"
        date = "2026-02-15"
        description = "Detects WordPress comment payloads exploiting CVE-2026-18510 via percent-encoded gettext markers"
        cve = "CVE-2026-18510"
        severity = "high"
    strings:
        $marker_enc = "%23!trpst%23" ascii nocase
        $marker_enc_alt = "%23%21trpst%23" ascii nocase
        $onerror = "onerror=" ascii nocase
        $onload = "onload=" ascii nocase
        $img_tag = "<img" ascii nocase
        $svg_tag = "<svg" ascii nocase
        $iframe_tag = "<iframe" ascii nocase
    condition:
        (uint16(0) == 0x3c21 or filesize < 10KB) and
        ($marker_enc or $marker_enc_alt) and
        ($onerror or $onload) and
        ($img_tag or $svg_tag or $iframe_tag)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-18510 TranslatePress Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"comment="; http_client_body; content:"%23!trpst%23"; http_client_body; nocase; content:"onerror="; http_client_body; nocase; sid:2026185101; rev:1; reference:cve,2026-18510; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.type == "connection" and destination.port == 80]
  [http where event.type == "request" and
     url.query contains "%23!trpst%23" and
     url.query regex "onerror=|onload=|onclick="]

Splunk SPL Query

index=web* sourcetype=access_combined
| where LIKE(form_data, "%comment=%") AND (LIKE(form_data, "%23!trpst%23") OR LIKE(form_data, "%23%21trpst%23")) AND (LIKE(form_data, "%onerror=") OR LIKE(form_data, "%onload="))
| table _time, src_ip, uri, form_data, user_agent

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100510" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.php</field>
    <field name="comment" type="pcre2">%23!trpst%23.*onerror=</field>
    <description>CVE-2026-18510: TranslatePress Stored XSS payload detected in comment submission</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patched version has been released by the vendor. The vendor has not acknowledged the vulnerability, and no fix is available in any tracked repository or advisory as of this analysis.

Immediate Mitigations (no patch available):

1. Disable Comments: If multilingual comments are not essential, disable comments site-wide in WordPress Settings → Discussion. This eliminates the attack vector entirely.
2. Disable Guest Comments: In Settings → Discussion, uncheck "Allow people to post comments on new articles" and enforce user registration for commenting. This raises the bar but does not eliminate risk (authenticated low-privilege users can still exploit).
3. Install a WAF Rule: Deploy a web application firewall (e.g., Cloudflare, AWS WAF, ModSecurity) with a custom rule blocking requests to wp-comments-post.php that contain %23!trpst%23 in the POST body.
4. Content Security Policy (CSP): Add a strict CSP header that blocks inline script execution (script-src 'self'). This mitigates the impact if XSS is triggered by preventing JavaScript execution.
5. Comment Moderation: Ensure ALL comments from new users require manual approval, and manually review comments for encoded gettext markers (%23!trpst%23) before approving.

Patch/Upgrade Steps:

• Monitor the TranslatePress changelog and WordPress plugin repository for a version newer than 3.2.6. Update immediately upon release.
• Consider uninstalling the plugin entirely if multilingual functionality can be achieved through alternative means (e.g., WPML, Polylang, or manual translation).

Long-Term Hardening:

• Apply the principle of least privilege: restrict file write permissions on the WordPress installation directory (wp-content should be writable only by the web server user, not the PHP process).
• Regular security audits of installed plugins; remove any plugin that is unmaintained or has a history of vulnerabilities.
• Implement a WordPress security plugin (e.g., Wordfence, Sucuri) that includes virtual patching for known XSS vectors.
• Subscribe to the WordPress security mailing list and the plugin's changelog to stay informed of updates.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18510
2. Wordfence CNA Advisory: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/translatepress-multilingual/translatepress-326-unauthenticated-stored-cross-site-scripting-via-comment-content
3. WordPress Plugin Repository: https://wordpress.org/plugins/translatepress-multilingual/
4. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Threat Actor Activity: As of the analysis date, there is no publicly documented exploitation of this CVE in the wild. It is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The low EPSS score suggests no active exploitation campaigns are underway, but the trivial attack vector (comment submission) means threat actors specializing in WordPress mass exploitation may add this to their playbooks once details circulate in underground forums. Security teams should treat this as a high-priority remediation item due to the unauthenticated and stored nature of the vulnerability.