CVE-2026-107768: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation

CVE-2026-107768 describes a stored cross-site scripting vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin. Versions up to and including 3.3.7 are affected due to improper neutralization of input during web page generation, specifically via the 'comment' parameter. This flaw allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Successful exploitation depends on the site allowing unmoderated comment submissions on at least one post and having a secondary language configured, conditions common in TranslatePress deployments.

An attacker can inject persistent malicious scripts into pages viewed by other users, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires no authentication and has a low attack complexity, making it a significant risk for affected sites that meet the exploitation conditions. The CVSS score of 7.2 (high) reflects the confidentiality and integrity impact, with no availability impact.

No official patch or fix is currently documented. Administrators should verify the vendor advisory for updates. As a temporary mitigation, disabling unmoderated comment submissions or removing secondary language configurations may reduce exposure. Monitoring for updates from the vendor is critical to apply an official fix once available.