Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress… (CVE-2026-103062)

CVE-2026-103062 describes a stored cross-site scripting vulnerability in Cozmoslabs TranslatePress (translatepress-multilingual) affecting versions up to 3.3.6. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist and execute in users' browsers. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Cozmoslabs' official channels for updates and apply any forthcoming patches promptly.