CVE-2026-18512 is a stored cross-site scripting vulnerability (CWE-79) in the TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin. The flaw exists due to improper neutralization of input during web page generation, specifically in the Approved Comment Body Rendered in Translation Editor Strings Dropdown. This allows authenticated attackers with subscriber-level privileges or above to inject malicious scripts that execute in the context of other users viewing the injected pages. The vulnerability affects all versions up to and including 3.2.6. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation allows authenticated users with subscriber-level access or higher to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect availability and requires user interaction (visiting the injected page).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user privileges to trusted users only and monitor for suspicious activity related to comment inputs and translation editor usage. Avoid granting unnecessary permissions to reduce risk.