CVE-2026-96575 is a stored cross-site scripting vulnerability in the Transliterator – Multilingual and Multi-script Text Conversion WordPress plugin (versions up to and including 2.5.8). The flaw exists because the plugin does not properly sanitize or escape input in comment content, specifically via a predictable {rstr_keep} placeholder. Malicious scripts injected by unauthenticated attackers persist in comments and execute in the context of users viewing those pages. The payload evades WordPress's core comment kses filtering because it uses allowed tags and attributes (e.g., a[title], code) and the plugin's shortcode markers and placeholder tokens are not removed during sanitization.

An unauthenticated attacker can inject arbitrary web scripts into comment content that execute in the browsers of users who access the affected pages. This can lead to information disclosure or other client-side impacts. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling comments or restricting comment content to trusted users to reduce exposure. Avoid relying solely on WordPress core sanitization as it does not prevent this issue due to allowed tags and plugin-specific placeholders.