CVE-2026-18512

Executive Summary

CVE-2026-18512 is a Stored Cross-Site Scripting (XSS) vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress, affecting all versions up to and including 3.2.6. The flaw resides in the rendering of approved comment bodies within the translation editor's strings dropdown, stemming from insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute whenever an administrator or other privileged user accesses an affected page, potentially leading to session hijacking, privilege escalation, or site-wide compromise. The vulnerability carries a CVSS score of 6.4 (Medium) with a scope change indicating the compromised component extends beyond the plugin's immediate security boundary.

Technical Analysis

The TranslatePress plugin for WordPress provides multilingual translation capabilities through both automated AI translation and manual user-guided translation workflows. The plugin's translation editor presents translators with a dropdown interface showing strings extracted from site content, including user-generated content such as blog post comments. The vulnerability specifically affects the "Approved Comment Body Rendered in Translation Editor Strings Dropdown" — meaning that when a comment is approved by a moderator, its body content is pulled into the translation editor's string selection interface without adequate sanitization or output escaping.

Vulnerability Mechanism:

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which covers cross-site scripting. The plugin fails to properly sanitize comment body input before it is rendered inside the translation editor's dropdown component. Specifically, the plugin does not apply sufficient input sanitization at the point of data ingestion, nor does it apply output escaping at the point of rendering within the administrative translation interface. This dual failure allows HTML and JavaScript payloads embedded within approved comment bodies to be interpreted as executable code rather than treated as inert text content.

Attack Surface:

The attack surface is the WordPress comment submission system combined with the TranslatePress translation editor admin interface. The attacker requires subscriber-level authentication, which is the default minimal privilege level for registered users on a WordPress installation. This low barrier to entry significantly broadens the pool of potential attackers — any subscriber account, including those created through open registration, can be leveraged for exploitation.

Technical Constraints:

The NVD description does not provide specific function names, class names, or code-level file paths for the vulnerable code. Whitout specific technical details, the analysis must remain at the vulnerability-class level. The flaw is characteristic of WordPress plugins that fail to apply esc_html(), esc_attr(), wp_kses_post(), or similar sanitization/escaping functions to data destined for HTML context rendering within administrative interfaces.

Scope and Impact Vector:

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reveals several important characteristics: the attack is network-based (AV:N), requires low attack complexity (AC:L), needs only low privileges (PR:L — subscriber), requires no user interaction (UI:N), and — most significantly — involves a scope change (S:C). The scope change indicates that a compromise of the plugin's component can affect resources beyond its security authority, namely the entire WordPress installation. Confidentiality and integrity impact are both rated Low, while availability impact is None. The low confidentiality/integrity ratings reflect the authenticated prerequisite and the fact that the primary outcome is XSS execution, though the scope change amplifies the practical risk considerably.

Exploitation Scenarios

Attack Chain Overview:

No public proof-of-concept code is available, and no exploit code has been observed in the wild. The attack chain described below is inferred from the vulnerability class and the NVD description, not from documented exploitation.

Step 1: Reconnaissance & Target Identification

An attacker would first identify WordPress sites running the TranslatePress plugin. This reconnaissance can be performed by fingerprinting the plugin through its published assets, page source comments, or plugin-specific URL patterns. The attacker would then verify the plugin version is 3.2.6 or earlier, which is vulnerable. Additionally, the attacker confirms that a subscriber-level account can be obtained — either through open user registration, or by compromising/creating a low-privileged account on the target site.

Step 2: Crafting the Malicious Comment Payload

The attacker crafts a comment containing embedded HTML and JavaScript. Because the vulnerability requires the comment to be "approved" for the payload to render in the translation editor, the attacker has two paths:

• If the site auto-approves comments from registered subscribers (a common configuration for trusted registered users), the malicious comment is immediately approved.
• If manual moderation is required, the attacker's comment sits in the moderation queue. The payload activates only when a moderator approves the comment and subsequently uses the TranslatePress translation editor on the page containing the comment. This introduces a social engineering or patience element to the attack.

The payload would be structured as HTML with inline JavaScript, for example: <script>/* malicious code */</script> or event-handler attributes such as <img src=x onerror=alert(1)> — though specific payload structures are not documented for this CVE.

Step 3: Triggering Execution in the Translation Editor

When an administrator or translator with access to the TranslatePress plugin opens the translation editor and navigates to the strings dropdown for a page containing the attacker's approved comment, the plugin renders the comment body directly into the dropdown's HTML without proper output escaping. The browser interprets the embedded script as active content, executing it within the context of the WordPress admin session — typically with administrator-level privileges.

Step 4: Post-Exploitation

At the vulnerability-class level, stored XSS in an administrative context enables a range of post-exploitation activities:

• Session Hijacking: Stealing the admin's session cookies and impersonating the administrator.
• Privilege Escalation: Creating new administrative accounts or modifying existing user permissions.
• Backdoor Installation: Injecting persistent client-side or server-side backdoors (e.g., adding malicious admin users, modifying plugin configurations).
• Site Defacement: Modifying page content or injecting persistent client-side malware for site visitors.
• Data Exfiltration: The attacker can operate entirely within the authenticated admin context, making requests to WordPress admin AJAX endpoints on behalf of the victim administrator to extract sensitive content or configuration data.

Practical Constraints: Because exploitation requires a victim to view the affected page within the translation editor, the attack window depends on translator/administrator activity. The comment must be approved, and the administrator must actively use the translation editor on pages containing that comment. This is not a fire-and-forget attack; it requires timing and a degree of social engineering to ensure the victim performs the triggering action.

Impact Assessment

Business Impact:

• Confidentiality Impact (Low per CVSS): The attacker could extract limited sensitive information from the admin context due to the scope change. This may include user data, site configuration, or internal plugin data accessible through the admin interface.
• Integrity Impact (Low per CVSS): The attacker could modify site content, plugin settings, or user accounts, though the constrained nature of the XSS execution limits the immediate scope of modification.
• Availability Impact (None): The vulnerability does not directly enable denial-of-service conditions.

Affected Systems:

All WordPress installations running TranslatePress versions up to and including 3.2.6 are affected. Given that TranslatePress is distributed through the official WordPress plugin repository and has a substantial user base for multilingual site management, the blast radius includes a significant population of multilingual WordPress deployments across e-commerce, corporate, and content-publishing sectors.

Blast Radius Analysis:

Despite the Medium severity rating (6.4), the practical risk is elevated by three factors:

1. Low Privilege Requirement: Subscriber-level access is trivial to obtain on sites with open registration.
2. Scope Change: The plugin's compromise extends to the entire WordPress application, not just the plugin's own functionality.
3. Stored Nature: The payload persists until the comment is deleted, providing a broad exploitation window across multiple sessions and users.

The attack is, however, constrained by the requirement for a victim to actively navigate to the translation editor's strings dropdown. This human-trigger requirement lowers the likelihood of automated mass exploitation but does not eliminate the risk for targeted attacks against specific sites.

Example Risk Scenario: A multilingual corporate blog with open user registration and the TranslatePress plugin installed. An attacker registers a free subscriber account, posts a benign-looking comment containing a crafted XSS payload, and waits. When the site's marketing administrator logs in to translate the blog post into another language via the translation editor, the script executes, the attacker steals the admin session, creates a new admin account, and gains persistent control of the WordPress site — all from a subscriber-level entry point.

Detection Guidance

Sigma Rule

title: WordPress TranslatePress Stored XSS - Comment Payload via Translation Editor
id: a7f2e1c4-9b3d-4e6f-8a2c-5d1b7e9f0c3a
status: experimental
description: Detects attempts to exploit CVE-2026-18512 by identifying comment submissions containing script-like payloads on WordPress sites with TranslatePress enabled.
logsource:
  category: web_application
  product: wordpress
  service: comments
detection:
  selection_comment_payload:
    comment_approved: '1'
    comment_content|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<iframe'
      - '<svg'
  selection_translatepress_present:
    plugin_name: 'translatepress-multilingual'
  condition: selection_comment_payload and selection_translatepress_present
level: high
falsepositives:
  - Legitimate users using HTML in comments (rare on default WordPress configs)
  - Code snippets shared in technical discussions
tags:
  - attack.t1059.007
  - cve.2026-18512
  - cwe.79

YARA Rule

rule CVE_2026_18512_TranslatePress_XSS_Payload {
    meta:
        author = "Valter's IT Threat Intelligence"
        description = "Detects web payload patterns targeting the TranslatePress Stored XSS vulnerability (CVE-2026-18512)"
        cve = "CVE-2026-18512"
        severity = "medium"
        date = "2026-01-01"
    strings:
        $script_tag = "<script" ascii nocase
        $event_handler = /on(error|load|click|mouseover)\s*=/ ascii nocase
        $javascript_protocol = "javascript:" ascii nocase
        $iframe_tag = "<iframe" ascii nocase
        $svg_tag = "<svg" ascii nocase
        $comment_context = "comment-body" ascii nocase
        $translation_editor = "trp-translation-editor" ascii nocase
    condition:
        any of ($script_tag, $event_handler, $javascript_protocol, $iframe_tag, $svg_tag)
        and file_size < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-18512 TranslatePress Stored XSS - Comments Payload";
  flow:established,to_server;
  content:"POST"; http_method;
  content:"/wp-comments-post.php"; http_uri;
  content:"comment="; http_client_body;
  pcre:"/comment=.*(?:<script|onerror\s*=|onload\s*=|javascript\s*:|<iframe|<svg)/i";
  classtype:web-application-attack;
  reference:cve,2026-18512;
  sid:2026185121; rev:1;)

Elastic Detection

// Detect comment POST requests with XSS payload characteristics
// on WordPress installations
network where process.executable != null and
  event.category == "web" and
  network.protocol == "http" and
  url.path == "/wp-comments-post.php" and
  http.request.method == "POST" and
  (
    http.request.body.content contains "<script" or
    http.request.body.content matches "onerror\\s*=" or
    http.request.body.content matches "onload\\s*=" or
    http.request.body.content contains "javascript:" or
    http.request.body.content contains "<iframe" or
    http.request.body.content contains "<svg"
  )

// Additionally, detect admin session access to translation editor after
// a potentially malicious comment was posted
sequence with maxspan=1h
  [ network where http.request.method == "POST" and url.path == "/wp-comments-post.php" ]
  [ process where event.action == "access" and url.path like "*trp*" ]

Splunk SPL Query

index=web sourcetype="iis" OR sourcetype="apache:access" OR sourcetype="nix:syslog"
  (uri="/wp-comments-post.php" OR uri_path="/wp-comments-post.php")
  AND method="POST"
  AND (
    http_user_agent="*"
  )
  | rex field=_raw "comment=(?<comment_payload>.*?)(?:&|$)"
  | where
      like(comment_payload, "%<script%") OR
      comment_payload LIKE "%onerror=%" OR
      comment_payload LIKE "%onload=%" OR
      comment_payload LIKE "%javascript:%" OR
      comment_payload LIKE "%<iframe%" OR
      comment_payload LIKE "%<svg%"
  | table _time, src_ip, uri, comment_payload
  | sort -_time
  | eval threat="CVE-2026-18512 TranslatePress Stored XSS"

Wazuh OSSEC Rule

<group name="wordpress_xss,">
  <rule id="213830" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/wp-comments-post\.php</field>
    <field name="command">POST</field>
    <regex>comment=.*(&lt;script|onerror\s*=|onload\s*=|javascript\s*:|&lt;iframe|&lt;svg)</regex>
    <description>CVE-2026-18512: WordPress TranslatePress Stored XSS - malicious comment payload detected</description>
    <group>attack.t1059.007,cwe.79,cve.2026-18512,</group>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The NVD (National Vulnerability Database) reports a patch exists, but this claim has not been independently confirmed via a vendor advisory, release notes, or changelog from the TranslatePress vendor. The vendor fix reference is marked as "N/A" in the available intelligence data, meaning the specific patched version number has not been confirmed. This is a significant caveat — enterprises should verify the patch's existence and applicability before relying upon it.

1) Immediate Mitigations:

• Disable open user registration on WordPress sites running TranslatePress versions ≤ 3.2.6. This immediately removes the subscriber-level attack surface for externally registered users.
• Restrict subscriber permissions: Review and tighten the default role capabilities for subscriber accounts. Limit which roles can post comments, or require all comments from subscribers to undergo manual moderation before being approved.
• Enable manual comment moderation: Ensure all comments require moderator approval, and verify that the moderation queue is actively reviewed so that malicious payloads are never approved.
• Implement a Web Application Firewall (WAF): Deploy WAF rules that block comment submissions containing script tags or event-handler attributes (e.g., <script>, onerror=) to provide an external layer of defense.
• Restrict admin access: Limit the number of administrators and translators who access the translation editor, reducing the potential victim pool.
• Input filtering plugin: Install a security plugin that adds HTML filtering capabilities to comment fields as a defense-in-depth measure.

2) Patch / Upgrade Steps:

• Verify patch availability: Check the official WordPress plugin repository for TranslatePress and confirm whether version 3.2.7 (or a later patched version) is listed. The official Wordfence or WPScan advisories may provide independent confirmation of the patch.
• Upgrade to patched version: Once confirmed, update TranslatePress to the latest patched version via the WordPress admin dashboard (Plugins → Installed Plugins → Update) or via command-line WP-CLI (wp plugin update translatepress-multilingual).
• Test in staging: Prior to production deployment, test the patched plugin on a staging environment to ensure translation functionality remains intact.
• Verify post-update integrity: After upgrade, confirm via the site health check or plugin status page that the installed version matches the patched release.

3) Long-Term Hardening:

• Establish a patch management cadence: Subscribe to WordPress plugin security advisories (Wordfence, WPScan) and apply plugin updates within 7 days of release for Medium-severity CVEs.
• Implement a least-privilege model: Review all user roles and remove unnecessary permission grants. Default subscriber accounts should have minimal capabilities, and comment capabilities should be re-evaluated.
• Adopt a Content Security Policy (CSP): Deploy a CSP header that restricts script sources and disables inline script execution where possible, mitigating the impact of any residual XSS.
• Deploy a WordPress-specific security layer: Use a robust security plugin or managed WP security service that provides file integrity monitoring, malware scanning, and virtual patching.
• Monitor threat intelligence feeds: Track CVE-2026-18512 in vulnerability management platforms and watch for updates on exploit-in-the-wild status, proof-of-concept publication, or independent patch confirmation.
• Conduct regular security audits: Perform periodic review of comment moderation workflows and administrative interface exposure to identify unused or exposed components.

References

1. NVD Entry for CVE-2026-18512 — Official National Vulnerability Database record. Contains the canonical CVSS vector, CWE classification, and NVD description. Available at: https://nvd.nist.gov/vuln/detail/CVE-2026-18512

2. TranslatePress Plugin Repository — Official WordPress plugin page to verify current version and patch status. Available at: https://wordpress.org/plugins/translatepress-multilingual/

3. Wordfence Vulnerability Database — Independent WordPress security vendor tracking vulnerability advisories. Search for "TranslatePress" CVE-2026-18512 for independent patch confirmation. Available at: https://www.wordfence.com/threat-intel/vulnerabilities/

4. WPScan Vulnerability Database — WordPress-specific vulnerability scanning and advisory service. Search for CVE-2026-18512 for additional technical analysis. Available at: https://wpscan.com/

5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-18512 is not currently listed in the KEV catalog, indicating no known exploitation in the wild as of the intelligence cut-off date. Available at: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Coverage: No known threat actor campaigns targeting CVE-2026-18512 have been identified at the time of this report. No exploit code, proof-of-concept, or Nuclei templates are publicly available. EPSS (Exploit Prediction Scoring System) has not yet scored this vulnerability. Organizations should monitor these sources as score publication and exploit development are likely given the popularity of WordPress plugins in targeted attacks.