The TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin versions up to 3.2.5 contain a reflected cross-site scripting vulnerability in the 's' parameter. The translate_page() function replaces internal marker tokens (#trpst# and #trpen#) with literal angle brackets in the HTML output after WordPress has sanitized user input. Since these tokens are not HTML special characters, this replacement bypasses WordPress's escaping mechanisms, allowing injection of arbitrary web scripts. An unauthenticated attacker can exploit this by tricking users into clicking specially crafted links, causing script execution in the victim's browser.

Successful exploitation allows an unauthenticated attacker to perform reflected cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in information disclosure or other client-side impacts. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the affected 's' parameter or applying web application firewall rules to detect and block malicious payloads targeting this parameter.