CVE-2026-89412 is a stored cross-site scripting vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin, affecting all versions up to and including 3.3.5. The vulnerability occurs because the plugin's Translation Memory Suggestion Panel uses v-html on suggestion.original without proper input sanitization or output escaping. The front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence, and the original column is deliberately exempt from kses filtering, allowing unauthenticated attackers to inject arbitrary executable HTML scripts. These scripts execute in the context of an administrator's session when they access the injected page.

An unauthenticated attacker can inject malicious scripts into the translation dictionary's original column, which are then stored and executed in the context of an administrator's browser session. This can lead to partial confidentiality and integrity loss (CVSS impact: Confidentiality Low, Integrity Low), but does not affect availability. The vulnerability allows execution of arbitrary web scripts, potentially enabling session hijacking, privilege escalation, or other attacks within the administrator's session.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Translation Memory Suggestion Panel and avoid using untrusted translation inputs. Monitor for updates from the vendor and apply patches promptly once released.