What is CVE-2026-75981?
An unauthenticated Stored XSS vulnerability exists in the TranslatePress plugin for WordPress up to version 3.2.5. The gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>', allowing attackers to inject arbitrary JavaScript. Users should update the plugin to the latest version.
Azərbaycanca: WordPress üçün TranslatePress plaginində (3.2.5-ə qədər versiyalarda) autentifikasiya olunmamış Stored XSS zəifliyi aşkar edilib. '#!trpst#' və '#!trpen#' markerləri filtrasiya olunmadan '<' və '>' simvollarına çevrilir, bu da təcavüzkara ixtiyari JavaScript kodu daxil etməyə imkan verir. Plaginin ən son versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-79
FAQ1
What mechanism allows the exploitation of the unauthenticated Stored XSS vulnerability in the TranslatePress plugin?
The vulnerability occurs because the '#!trpst#' and '#!trpen#' markers are unconditionally rewritten to '<' and '>' without sanitization, allowing an attacker to create script tags and inject arbitrary JavaScript code.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.