The TranslatePress WordPress plugin up to version 3.2.5 is vulnerable to unauthenticated stored cross-site scripting due to improper neutralization of input during web page generation. Specifically, the plugin replaces the markers '#!trpst#' and '#!trpen#' with angle brackets, enabling attackers to embed HTML tags in comments that bypass wp_kses sanitization. The function remove_tags_from_output() only removes <script> and <style> tags, allowing tags like <img onerror=...> to execute arbitrary JavaScript in the context of site visitors when the post is viewed in a translated language. This vulnerability is tracked as CVE-2026-75981 with a CVSS 3.1 score of 7.2 (high severity). No official patch or remediation guidance is currently provided.

An unauthenticated attacker can inject malicious HTML tags into comments that are stored and later rendered in translated versions of posts. This leads to execution of arbitrary JavaScript in the browsers of site visitors, potentially resulting in session hijacking, defacement, or other client-side attacks. The vulnerability affects confidentiality and integrity of user interactions with the affected site. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the TranslatePress plugin or restricting comment submissions to trusted users. Monitor official vendor channels for updates and apply patches promptly once released.