CVE-2026-18512: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation

CVE-2026-18512 is a stored cross-site scripting vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress. The flaw exists in all versions up to and including 3.2.6 due to improper neutralization of input during web page generation, specifically in the Approved Comment Body Rendered in the Translation Editor Strings Dropdown. Authenticated attackers with subscriber-level or higher privileges can inject malicious scripts that execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking.

An attacker with subscriber-level or higher access can inject arbitrary scripts that execute in the browsers of users viewing the affected pages. This can lead to information disclosure and limited integrity impact. The vulnerability does not affect availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and consider disabling or limiting use of the Translation Editor Strings Dropdown feature if possible. Monitor vendor channels for updates and apply official patches once released.