CVE-2026-66582: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Cozmoslabs TranslatePress

CVE-2026-66582 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in TranslatePress versions <= 3.3.2. The flaw arises from improper neutralization of input during web page generation, categorized under CWE-79. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and requiring user interaction. Successful exploitation can impact confidentiality, integrity, and availability.

Exploitation of this vulnerability can allow remote attackers to execute arbitrary scripts in the context of the affected web application without authentication. This may lead to unauthorized disclosure of information, modification of web content, or disruption of service. The CVSS vector indicates partial impact on confidentiality, integrity, and availability.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or filtering at the application or web server level to mitigate XSS risks.