Phrase TMS Integration for WordPress

Phrase TMS Integration for WordPress has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Phrase TMS Integration for WordPress has a vendor fix available, so running the current release closes it.

All of these findings were reported by Legion Hunter. Phrase TMS Integration for WordPress is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Phrase TMS Integration for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2025-12168

Phrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion

Read the full analysis

Vulnerability Records

1 records
Phrase TMS Integration for WordPress banner
Latestv4.9.1

Phrase TMS Integration for WordPress

Phrase

Author

Phrase

4.0(4)
80/100
Last Updated
2026-10-19 (9d ago)
Active Installs
200+
Downloads
63,138
Requires WP
4.9+
Requires PHP
7.4+
Tested up to
WP 7.0.7
Created
2016-10-08 (10y ago)

We’re transforming language technology, opening the door to global business so you can reach more people, make deeper connections, and drive growth. Phrase is the leading translation management system, offering a comprehensive suite of translation tools that’s intuitive to use and simple to integrate so you can focus on forming deeper connections with people across cultures. We help organizations like Uber, Shopify, Volkswagen, and thousands of others accelerate their global growth by giving people the content they need, in the language they speak. At Phrase, we: Use the latest technology to translate more efficiently and accurately, supporting 500+ languages, 50+ file types, and 30+ machine translation engines. Manage massive volumes of translation with advanced automation, machine learning, and AI features to deliver resonant content that reflects your message, regardless of its language. Make localization an essential driver of business growth with the only vendor-neutral provider on the market that offers a complete translation management solution and software localization platform for developers. Features Seamlessly translate your WordPress posts, pages, tags, categories, and custom post types Automatically send content for translation and track translation progress without leaving WordPress Compatible with a wide range of WordPress plugins including Avada, Divi, Elementor, Gutenberg, Yoast SEO, SEOPress, WPBakery Page Builder and Avia Boost productivity and reduce costs with AI-powered machine translation. Phrase TMS supports 30+ machine translation engines and automatically selects the optimal engine for your content. Live In-context Preview gives translators proper context while they’re working. Translators can see exactly how their translations will look on the page, reducing feedback loops and improving translation quality After building a custom shortcode in a third party plugin, add it to your WordPress site with our shortcode editor and translate shortcode content. The Phrase TMS Integration supports both WPML and MultilingualPress. The integration is available with the Ultimate and Enterprise Phrase TMS plans. Contact us for licensing information, or to schedule a demo. Developer Hooks The plugin exposes two PHP filters so you can define which custom Gutenberg block and shortcode attributes are translatable in your own version-controlled code (e.g. a functions.php or a site-specific mu-plugin), instead of only through the admin UI. Each filter receives the configuration already assembled from the plugin’s shipped defaults and the admin UI, and must return the final configuration the plugin will use — sites that don’t define either filter are unaffected. Register your callback at the top level of functions.php, a mu-plugin, or a regular site plugin — not from inside a conditional hook (e.g. only on is_admin() or a specific page request) that may not run on the REST API or content-transform requests this plugin’s hooks resolve on. memsource_custom_blocks Runs when the plugin resolves which Gutenberg block attributes are translatable. Receives the attributes already assembled from the shipped defaults and the admin UI, keyed by block name, and must return the same shape: add_filter('memsource_custom_blocks', function (array $blocks): array { $blocks['my-plugin/testimonial']['authorName'] = true; $blocks['my-plugin/testimonial']['quote'] = true; return $blocks; }); For an attribute you add or change, the value must be the boolean true. (The shipped/admin-UI values you receive are usually true too, but aren’t guaranteed to be — don’t rely on their exact form, only ever set your own attributes to true.) An attribute name ending in * (e.g. &#8216;item*’ => true) is expanded the same way as shipped/admin-configured wildcard attributes. memsource_custom_shortcodes Runs when the plugin resolves its shortcode configuration (type, tag, attributes). Receives the list of shortcode definitions already assembled from the shipped defaults and the admin UI, and must return the final list the plugin will use as-is — there is no merging or deduplication after this filter runs. An entry already sourced from the database (as opposed to one you add or fully replace yourself) carries extra database detail: its editable/ignore_body values may be the database driver’s string form ('0'/'1') rather than a native boolean, the shortcode entry itself carries a database id, and each of its attributes carries id/short_code_id too. These are implementation detail of the existing data, not something you need to set — an entry you add or fully replace only needs the fields shown below. Shortcode identity is the (tag, editable) pair (tag compared case-insensitively) — the same identity the plugin already uses to resolve its shipped/admin-UI configuration. Your callback is responsible for keeping the returned list valid: To change an existing shortcode’s configuration (shipped or already in the database), find its entry in the list you received and modify it in place — don’t append a second entry for the same (tag, editable) pair. To add a new shortcode, append an entry whose (tag, editable) pair doesn’t already exist in the list you received. The list you return should not contain more than one entry for the same (tag, editable) pair. The plugin does not enforce or repair this itself, including a pre-existing duplicate already in the shipped/database data: a duplicate identity is not translated twice (the parser’s matching naturally has nothing left to do for a list entry once an earlier one has already processed that shortcode occurrence), but which duplicate’s settings apply to a given occurrence depends on list order and is not something this plugin defines or guarantees. Leave an identity you don’t intend to touch untouched; don’t try to deduplicate it yourself. Change an existing shortcode’s configuration by modifying its entry in place: add_filter('memsource_custom_shortcodes', function (array $shortcodes): array { foreach ($shortcodes as $key => $shortcode) { if ($shortcode['tag'] === 'vc_column_text') { $shortcodes[$key]['attributes'][] = [ 'name' => 'title', 'type' => null, 'encoding' => null, 'editable' => false, 'status' => 'Active', ]; break; } } return $shortcodes; }); Add a new shortcode by appending it: add_filter('memsource_custom_shortcodes', function (array $shortcodes): array { $shortcodes[] = [ 'type' => 'My Plugin', 'tag' => 'my_testimonial', 'ignore_body' => false, 'editable' => false, 'status' => 'Active', 'delimiter' => '"', 'attributes' => [ ['name' => 'author', 'type' => null, 'encoding' => null, 'editable' => false, 'status' => 'Active'], ], ]; return $shortcodes; });

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C