CVE-2026-103062: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Cozmoslabs TranslatePress

The vulnerability identified as CVE-2026-103062 in Cozmoslabs TranslatePress (translatepress-multilingual) is a stored cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that persist and execute in the context of users visiting affected pages. The affected versions include all releases from the initial version up to and including 3.3.6. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this stored XSS vulnerability can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data and application functionality.

No explicit patch or remediation details are provided in the input data. The affected versions are all releases prior to 3.3.7, implying that upgrading to version 3.3.7 or later would remediate the issue. Patch status is not yet confirmed in the vendor advisory; users should verify with Cozmoslabs for an official fix or update to 3.3.7 or later when available.