CVE-2026-76053

Executive Summary

CVE-2026-76053 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress, present in all versions up to and including 3.3.3. The vulnerability is triggered automatically without any prior authentication or elevated privileges, enabling unauthenticated attackers to inject arbitrary web scripts into translated pages that execute when any user accesses the affected page. The vulnerability carries a CVSS score of 7.2 (High) due to its network exploitability, low attack complexity, and scope change, though no public proof-of-concept or known active exploitation has been documented at this time.

Technical Analysis

The vulnerability resides in the TranslatePress plugin's handling of comments during the page translation process. The attack mechanism leverages WordPress's comment submission functionality combined with a parser vulnerability in the TranslatePress HTML processing pipeline.

Vulnerability Mechanism:

The NVD description identifies the flaw as originating from insufficient input sanitization and output escaping within the translation HTML parser. Specifically, the attack vector exploits a unique interplay between WordPress's comment validation layer and the TranslatePress parser:

1. Comment KSES Allowlist Bypass: WordPress applies KSES (a filtering function that strips disallowed HTML tags and attributes from user-submitted content) to comments before storage. Normally, this would strip malicious script payloads. However, the KSES allowlist permits a specific payload structure — described as an anchor tag featuring both href and title attributes alongside a code tag. This combination passes the WordPress comment sanitization checks.

2. Verbatim Database Storage: Because the payload structure is permitted by KSES, the malicious comment is stored verbatim in the WordPress database without modification. This bypasses the typical first-line defense against stored XSS in WordPress comments.

3. Parser Re-Processing: When a page containing a translated comment is processed by the TranslatePress plugin's HTML parser, the stored malicious comment is parsed as part of the translation flow. The insufficient output escaping during this parsing step allows the injected content to be interpreted as active script rather than inert text.

Attack Surface:

• The attack requires the WordPress installation to run the TranslatePress plugin (version ≤ 3.3.3) with the translation feature enabled on pages.
• The target page must allow comments (standard WordPress page/comment behavior).
• The attack is delivered through standard WordPress comment submission channels — no authentication is required, and the attacker does not need access to the WordPress administrative console.

Root Cause Classification (CWE-79): The failure to properly escape user-controlled content during the translation parser's output stage constitutes the core vulnerability. While the initial injection leverages the parser's acceptance of an apparently benign HTML structure, the failure to escape this content when rendering the translated page allows script execution.

Note on Technical Specifics: The NVD description does not disclose specific function names, class names, or source code paths within the TranslatePress plugin. The attack mechanism is described at the conceptual level: sanitization failure during comment handling and output escaping failure during parser processing. Without vendor source code analysis or a public technical write-up, the precise parser code location remains unidentified.

Exploitation Scenarios

Reconnaissance / Target Identification:

An attacker identifies WordPress sites running the TranslatePress plugin in version 3.3.3 or earlier. This can be accomplished using:

• WordPress plugin enumeration tools (e.g., WPScan, wp-plugins enumeration).
• Search engine queries for TranslatePress-specific page source markers.
• Shodan/Censys queries targeting WordPress installations with the plugin's assets.

Attack Steps (class-level, inferred from NVD description):

1. Comment Injection: The attacker navigates to a WordPress page on the target that (a) is configured to accept comments, and (b) is processed by TranslatePress for translation. The attacker submits a comment containing the crafted payload structure — an anchor tag (<a>) with href and title attributes, combined with a <code> tag, embedding JavaScript that will execute when parsed and rendered.

2. Bypassing WordPress Comment Filters: The payload must conform to what WordPress's KSES allowlist will accept (the anchor/code tag combination). Because this structure is whitelisted, the comment passes WordPress's standard comment sanitization and is stored in the wp_comments database table verbatim — the malicious script is not stripped.

3. Triggering the TransitPress Parser: When any user (administrator, visitor, or translator) accesses the page containing the injected translated comment, the TranslatePress parser processes the content. Due to the parser's insufficient output escaping of comment-derived page content, the injected script is rendered as executable JavaScript rather than being HTML-escaped.

4. Script Execution: The injected script executes in the context of the victim's browser session, within the domain of the target WordPress site.

Post-Exploitation Impact:

• Session Hijacking: An attacker can steal session cookies from administrators, enabling account takeover and potential full-site compromise.
• Credential Theft: The script can inject phishing forms or keyloggers against subsequent site visitors.
• Malware Distribution: Because the script persists and executes on every load by any user, the injected page can serve as a distribution point for drive-by download payloads.
• SEO Poisoning and Defacement: The attacker can modify visible page content or inject hidden links affecting the site's search ranking.
• Persistence: The stored nature of the payload means the attack remains active indefinitely until the malicious comment is manually removed from the database.

Note on PoC Status: No public proof-of-concept, exploit code, or Nuclei template is available as of this writing. The exploitation chain described is inferred from the NVD description's mechanism outline (KSES allowlist bypass → database persistence → parser processing failure) and the CWE-79 vulnerability class. Attackers with familiarity with WordPress comment injection vectors and the TranslatePress source code could construct a working exploit with moderate effort.

Impact Assessment

Business Impact (CVSS-based assessment):

• CVSS Score: 7.2 (High)
• Attack Vector (AV:N): Remotely exploitable over the network; no physical or local access required.
• Attack Complexity (AC:L): Low complexity — no special conditions required for a successful attack beyond the vulnerable configuration existing.
• Privileges Required (PR:N): None — the attack is performed by unauthenticated visitors; no account or administrative privileges are required.
• User Interaction (UI:N): None — the victim does not need to click a link or perform any action for the script to execute.
• Scope (S:C): The vulnerability's impact extends beyond the vulnerable component; the injected script affects the broader WordPress application and its users.
• Confidentiality Impact (C:L): Limited information disclosure possible (e.g., session tokens, sensitive page data).
• Integrity Impact (I:L): Limited data modification possible (e.g., page content tampering, credential phishing).

Affected Systems:

• WordPress sites running TranslatePress plugin versions ≤ 3.3.3.
• Any WordPress deployment with comments enabled on pages or posts that are processed by the translation plugin.

Blast Radius:

The scope-change and cross-site scripting characteristics mean that any user who views an affected translated comment page is a potential victim. This includes site visitors, content editors, and administrators. Since the payload is stored, every subsequent page view re-triggers the exploit, meaning the attack's effectiveness grows with site traffic volume. Additionally, if an administrator is compromised (session theft), the attacker could escalate to full site control — installing backdoor plugins, modifying themes, or exfiltrating the entire database.

Known Campaigns: No evidence of active exploitation campaigns, in-the-wild attacks, or inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the report date.

Detection Guidance

Sigma Rule

title: TranslatePress Stored XSS via Comments - Payload Pattern
id: 2a48c32d-8d5e-4d6a-9c1e-3e75cb8f421a
status: experimental
description: Detects comment submissions containing anchor+code tag structures that could exploit the TranslatePress stored XSS vulnerability (CVE-2026-76053)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76053
author: ValtersIT Threat Intelligence
date: 2026/05/15
logsource:
    category: application
    product: wordpress
    service: comments
detection:
    selection_http:
        http.method: 'POST'
        http.url|endswith: '/wp-comments-post.php'
        http.body|contains|all:
            - '<a'
            - 'href='
            - 'title='
            - '<code'
    selection_payload_indicators:
        http.body|contains|any:
            - '<script'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'onclick='
            - '&lt;script'
            - '\x3cscript'
    condition: selection_http and selection_payload_indicators
falsepositives:
    - Legitimate comments that include HTML code samples (rare in comment fields)
    - Users genuinely posting code snippets containing anchor tags
fields:
    - client.ip
    - http.user_agent
    - http.body
level: medium

YARA Rule

rule TranslatePress_StoredXSS_CVE_2026_76053 {
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects payload patterns associated with CVE-2026-76053 stored XSS in TranslatePress"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76053"
        cve = "CVE-2026-76053"
        date = "2026-05-15"
        severity = "high"

    strings:
        $anchor_open = /<a[\s]+[^>]*href\s*=\s*["'][^"']*["'][^>]*title\s*=\s*["']/
        $anchor_rev = /<a[\s]+[^>]*title\s*=\s*["'][^"']*["'][^>]*href\s*=\s*["']/
        $code_tag = /<code[\s>]/
        $script_tag = /<script[\s>]/ nocase
        $js_handler = /on(error|load|click|mouseover|focus)\s*=\s*["']?javascript/i
        $js_obfuscated = /(&#x?[0-9a-fA-F]{2,4};)?\\(x|u)[0-9a-fA-F]{2,4}/ 

    condition:
        any of ($anchor_open, $anchor_rev) and $code_tag and (
            $script_tag or $js_handler or $js_obfuscated
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT TranslatePress Stored XSS via Comment Injection (CVE-2026-76053)"; flow:to_server,established; content:"POST"; http_method; content:"/wp-comments-post.php"; http_uri; content:"<a"; http_client_body; pcre:"/<a\s+[^>]*(href\s*=\s*[\"'][^\"']*[\"'][^>]*title\s*=\s*[\"'][^\"']*[\"']|title\s*=\s*[\"'][^\"']*[\"'][^>]*href\s*=\s*[\"'][^\"']*[\"'])[^>]*>/i"; http_client_body; content:"<code"; http_client_body; pcre:"/(<script|javascript:|on(error|load|click|mouseover|focus)\s*=\s*[\\\"'])/i"; http_client_body; sid:202676053; rev:1; reference:cve,2026-76053; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-76053; classtype:web-application-attack; priority:1;)

Elastic Detection

// Detect POST requests to WordPress comment endpoint with suspicious payload pattern
// Requires: packetbeat or filebeat with Apache/Nginx access logs, or APM web transaction data
sequence by source.ip with maxspan=1m
  [network where event.category == "web" and event.action == "request"
   and http.request.method == "POST" and http.request.url ends with "/wp-comments-post.php"
   and http.request.uri contains "comment_post_ID"]
  [network where event.category == "web" and event.action == "request"
   and http.request.method == "POST" and http.request.url ends with "/wp-comments-post.php"
   and (
     (http.request.body.content matches "<a\\s+[^>]*href\\s*=.*title\\s*=.*<code" ||
      http.request.body.content matches "<a\\s+[^>]*title\\s*=.*href\\s*=.*<code") &&
     (http.request.body.content matches "<script|javascript:|onerror\\s*=|onload\\s*=|onclick\\s*=")
   )]

Splunk SPL Query

sourcetype=access_combined OR sourcetype=iis OR sourcetype=apache
| eval request_data = if(isnull(uri_query), uri_path, uri_path + "?" + uri_query)
| search request_data="/wp-comments-post.php" action=post OR method=POST
| rex field=request_body "(?<payload_href>href\s*=\s*[\"'])"
| rex field=request_body "(?<payload_title>title\s*=\s*[\"'])"
| rex field=request_body "(?<payload_code><code)"
| rex field=request_body "(?<payload_script><script|javascript:|onerror\s*=|onload\s*=|onclick\s*=)"
| where isnotnull(payload_href) AND isnotnull(payload_title) AND isnotnull(payload_code) AND isnotnull(payload_script)
| table _time client_ip uri_path request_body status
| sort - _time

Wazuh OSSEC Rule

<group name="wordpress,web_application_attack,">
  <rule id="100253" level="10">
    <decoded_as>web</decoded_as>
    <field name="url">/wp-comments-post\.php</field>
    <field name="method">POST</field>
    <regex>(\&lt;\s*a\s+[^&gt;]*(href\s*=\s*[\"'][^\"']*[\"'][^&gt;]*title\s*=\s*[\"'][^\"']*[\"']|title\s*=\s*[\"'][^\"']*[\"'][^&gt;]*href\s*=\s*[\"'][^\"']*[\"'])[^&gt;]*\&gt;\s*\&lt;\s*code)</regex>
    <description>TranslatePress Stored XSS attempt detected (CVE-2026-76053) - comment POST with anchor+code payload</description>
    <group>wordpress,translatepress,xss,attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info>WordPress comment submission appears to contain the anchor+code structure targeting TranslatePress CVE-2026-76053. Review the payload for JavaScript handlers.</info>
    <alert>active</alert>
  </rule>

  <rule id="100254" level="12">
    <if_sid>100253</if_sid>
    <regex>(&lt;\s*script|javascript:|on(error|load|click|mouseover|focus)\s*=\s*)</regex>
    <description>TranslatePress Stored XSS confirmed payload (CVE-2026-76053) - JavaScript execution indicators present</description>
    <group>wordpress,translatepress,xss,attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

The NVD indicates that a patch exists, but at the time of writing this report the specific fixed version number has not been published in the reference data available. The affected range is described as "all versions up to, and including, 3.3.3," implying that a version greater than 3.3.3 may contain the fix, but this has not been independently confirmed.

1. Immediate Mitigations (Until Patch is Confirmed/Applied)

• Disable Comments on Translated Pages: If the TranslatePress plugin is mission-critical and cannot be updated immediately, the most effective short-term mitigation is to disable comments on pages and posts that are processed by the translation plugin. This eliminates the injection vector entirely, as the vulnerability requires a comment submission to deliver the payload.
• Enable Comment Moderation: Set WordPress comment settings to require manual approval before any comment appears on the site. This adds a human review layer that can catch malicious payloads before they are stored.
• Disable HTML in Comments: Use a WordPress plugin or filter that strips all HTML tags from comments (e.g., using pre_comment_content filter to apply wp_strip_all_tags()). While this may affect the anchor+code structure that surpasses KSES, it will also break legitimate formatting in comments.
• Web Application Firewall (WAF) Rules: Deploy a WAF rule (ModSecurity, Cloudflare, AWS WAF) to block POST requests to /wp-comments-post.php containing both anchor tags with href+title attributes and <code> tags combined with script indicators (<script, javascript:, event handlers).
• Content Security Policy (CSP): Implement a strict CSP header on the WordPress site with script-src 'self' (or a more restrictive value) to prevent inline script execution, which would neutralize the impact of the stored XSS even if the injection succeeds.

2. Patch/Upgrade Steps

• Identify the current installed version of TranslatePress (WordPress Admin → Plugins → Installed Plugins).
• Monitor the official WordPress plugin repository page for TranslatePress and the vendor's (Cozmoslabs) website for a security advisory containing the patched version.
• Do not apply updates based solely on third-party claims of a fix; verify the fixed version number directly from the official repository changelog or vendor advisory.
• Once a patched version is confirmed, test the upgrade on a staging environment that replicates the production configuration (comment settings, translation languages, custom post types).
• Apply the update in production during a maintenance window, then clear all object caches and any page caches that might retain cached translated HTML.

3. Long-Term Hardening

• Vulnerability Management Process: Establish a monthly schedule to audit WordPress plugins for known CVEs using WPScan, Snyk, or the WordPress Security Scanner tools. Prioritize plugins that handle user-submitted content or perform HTML parsing.
• Least Privilege for Comments: Disable comments by default on non-essential pages and posts where the TranslatePress plugin is active. Only enable comments where there is a documented business need.
• Input/Output Sanitization Audit: Review the TranslatePress parser configuration and apply WordPress's wp_kses_post() to all content rendered by the translation engine if the plugin exposes such hooks. If not available, file a feature request or consider an alternative translation plugin with more robust escaping.
• Monitor the CVE: Set up alerts for subsequent revisions to CVE-2026-76053 in the NVD to receive the confirmed patch version and any additional technical details (e.g., proof-of-concept release, exploitation reports).
• Security Logging: Enable detailed WordPress audit logging (e.g., WP Activity Log plugin) to record comment submission IPs, user agents, and content patterns for post-incident forensics.
• Database Integrity Monitoring: Implement periodic scans of the wp_comments table (or plugin-specific comment tables) for comments containing unusual HTML structures — specifically the anchor+code combination — to identify and purge hibernated malicious payloads.

References

1. NVD Entry: CVE-2026-76053 — https://nvd.nist.gov/vuln/detail/CVE-2026-76053

   • Official NVD vulnerability database entry containing the full description and CVSS vector information referenced throughout this report.

2. WordPress Plugin Repository — TranslatePress — https://wordpress.org/plugins/translatepress-multilingual/

   • Official plugin repository page; the definitive source for the patched version once published. Changelog and version history will confirm the exact fixed version.

3. Cozmoslabs — TranslatePress Product Page — https://www.cozmoslabs.com/wordpress-translate-plugin/

   • Vendor website; security advisories and release notes are expected to be posted here once the patch is officially announced.

4. MITRE ATT&CK — T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/

   • ATT&CK technique mapping for the exploitation of internet-facing web applications, aligning with the attack vector for this CVE.

5. OWASP — Cross-Site Scripting Prevention Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

   • Reference for the vulnerability class and recommended prevention mechanisms relevant to the CWE-79 classification.

Threat Actor / Exploitation Status: No known threat actor campaigns, in-the-wild exploitation reports, or CISA KEV listing exist for CVE-2026-76053 as of this report. The vulnerability is cataloged but has no public exploit code or active exploitation evidence. The patch status is unconfirmed (single-source claim), and organizations should treat the vulnerability as exploitable pending verified remediation.