The TranslatePress plugin for WordPress (versions up to and including 3.2.5) is vulnerable to unauthenticated stored cross-site scripting due to improper neutralization of input during web page generation. The plugin replaces special gettext markers '#!trpst#' and '#!trpen#' with angle brackets '<' and '>' in the translate_page() function, enabling attackers to embed these markers in comments that survive WordPress's wp_kses filtering. When the post is viewed in a secondary language, these markers are converted into real HTML tags such as <img> with event handlers like onerror, which execute arbitrary JavaScript in the victim's browser. The output filtering only removes <script> and <style> tags, leaving this attack vector open.

An unauthenticated attacker can inject malicious HTML and JavaScript code into comments that are stored and later rendered in translated pages. This can lead to execution of arbitrary scripts in the context of site visitors, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the TranslatePress plugin or restricting comment submission to trusted users. Monitor vendor communications for updates and apply official patches promptly once released.