CVE-2026-18510 is a stored cross-site scripting vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin. It affects all versions up to and including 3.2.6. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of URL-encoded gettext markers in comment content. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. The attack payload uses only allowed WordPress tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified, bypassing typical defenses. Comment moderation may delay exploitation for first-time commenters but does not prevent it.

An unauthenticated attacker can inject persistent malicious scripts into pages via comment content, which execute in the browsers of users who view those pages. This can lead to information disclosure and integrity impacts (such as session hijacking or content manipulation). Availability is not affected. The vulnerability has a CVSS 3.1 base score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed due to impact beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling comments or implementing stricter comment filtering to reduce risk. Comment moderation may delay exploitation but does not fully prevent it. Monitor vendor channels for updates and apply official patches once released.