CVE-2026-18510 is a stored cross-site scripting vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin, affecting all versions up to and including 3.2.6. The vulnerability is due to improper neutralization of input during web page generation, specifically via comment content containing URL-encoded gettext markers. Attackers can inject malicious scripts that execute in the context of users visiting the injected pages. The payload bypasses WordPress's wp_kses URL validation by using only allowed tags and percent-encoded characters. No authenticated privileges are required to exploit this vulnerability.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to information disclosure or user session compromise. The vulnerability impacts confidentiality and integrity but does not affect availability. Comment moderation may delay exploitation for new commenters but does not fully mitigate the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling comments or implementing stricter comment filtering to reduce risk. Monitor vendor channels for updates and apply patches promptly once available.