Threats tagged 'ghsa-fhvv-89cj-8528'

The TranslatePress plugin for WordPress up to version 3.2.6 is vulnerable to a stored cross-site scripting (XSS) flaw via comment content. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users view the affected pages. The exploit payload uses only WordPress-permitted tags and percent-encoded characters that bypass standard URL validation. Comment moderation may delay but does not prevent exploitation.