CVE-2026-76053: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation

CVE-2026-76053 is a stored cross-site scripting vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin. It affects all versions up to and including 3.3.3. The issue stems from improper neutralization of input during web page generation, specifically via comment noise-key injection into the HTML parser. The WordPress comment KSES allowlist permits an anchor tag with href and title attributes alongside a code tag, which attackers exploit to store malicious scripts in the database. These scripts execute when a user accesses the injected page, potentially leading to cross-site scripting attacks without requiring authentication.

An unauthenticated attacker can inject arbitrary web scripts into pages rendered by the TranslatePress plugin, which execute in the context of users visiting those pages. This can lead to information disclosure and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). The vulnerability does not require user interaction or privileges to exploit, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting comment submissions to trusted users to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.