TranslatePress – Translate Multilingual sites with AI Translation

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   TranslatePress – Translate Multilingual sites with AI Translation

Information

Software Type Plugin
Software Slug translatepress-multilingual (view on wordpress.org)
Software Status Active
Software Author cozmoslabs
Software Website translatepress.com
Software Downloads 20,565,694
Software Active Installs 400,000
Software Record Last Updated September 5, 2026

12 Vulnerabilities

Submit a Vulnerability
TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
7.2
CVE-2026-76053
Aug 27, 2026
Researcher: daroo
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
9.8
CVE-2026-19632
Aug 25, 2026
Researcher: Yuto Hyakumoto
TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
6.4
CVE-2026-18512
Aug 24, 2026
Researcher: Yuto Hyakumoto
TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-66582
Aug 19, 2026
Researcher: Quentin Lamour
TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-75981
Aug 18, 2026
Researcher: Pham Duc Anh
TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
7.2
CVE-2026-18510
Aug 5, 2026
Researcher: Pham Duc Anh
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
6.1
CVE-2026-17505
Aug 4, 2026
Researcher: Yuto Hyakumoto
TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection
8.1
CVE-2025-58592
Sep 24, 2025
Researcher: Phat RiO
TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection
7.2
CVE-2025-30773
Mar 27, 2025
Researcher: Ananda Dhakal
Translate Multilingual sites – TranslatePress <= 2.7.5 - Cross-Site Request Forgery
4.3
CVE-2024-34827
May 9, 2024
Researcher: Dhabaleshwar Das
TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3141
Jul 23, 2022
Researcher: Elias Hohl
TranslatePress <= 2.0.8 - Authenticated Stored Cross-Site Scripting
4.8
CVE-2021-24610
Aug 30, 2021
Researcher: apapedulimu
Title Status CVE ID CVSS Researchers Date
TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser Patched CVE-2026-76053 7.2 daroo August 27, 2026
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure Patched CVE-2026-19632 9.8 Yuto Hyakumoto August 25, 2026
TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor Patched CVE-2026-18512 6.4 Yuto Hyakumoto August 24, 2026
TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-66582 7.2 Quentin Lamour August 19, 2026
TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-75981 7.2 Pham Duc Anh August 18, 2026
TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content Patched CVE-2026-18510 7.2 Pham Duc Anh August 5, 2026
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting Patched CVE-2026-17505 6.1 Yuto Hyakumoto August 4, 2026
TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection Patched CVE-2025-58592 8.1 Phat RiO September 24, 2025
TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection Patched CVE-2025-30773 7.2 Ananda Dhakal March 27, 2025
Translate Multilingual sites – TranslatePress <= 2.7.5 - Cross-Site Request Forgery Patched CVE-2024-34827 4.3 Dhabaleshwar Das May 9, 2024
TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection Patched CVE-2022-3141 7.2 Elias Hohl July 23, 2022
TranslatePress <= 2.0.8 - Authenticated Stored Cross-Site Scripting Patched CVE-2021-24610 4.8 apapedulimu August 30, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation