TranslatePress – Translate Multilingual sites with AI Translation

TranslatePress – Translate Multilingual sites with AI Translation has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 13 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 8 high. 2026 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 7 of the records (54%). Other recurring categories include Deserialization Of Untrusted Data, Cross-Site Request Forgery (CSRF).

Every one of the 13 issues recorded for TranslatePress – Translate Multilingual sites with AI Translation has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (3) reported by Yuto Hyakumoto. TranslatePress – Translate Multilingual sites with AI Translation is installed on roughly 400,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891031.08.2017Today30.08.20214.8TranslatePress <= 2.0.8 - Authenticated Stored Cross-Site Scripting CVSS 4.8 · 30.08.202123.07.20227.2TranslatePress <= 2.3.2 - Authenticated (Administrator+) SQL Injection CVSS 7.2 · 23.07.202209.05.20244.3Translate Multilingual sites – TranslatePress <= 2.7.5 - Cross-Site Request Forgery CVSS 4.3 · 09.05.202427.03.20257.2TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection CVSS 7.2 · 27.03.202524.09.20258.1TranslatePress <= 2.10.2 - Unauthenticated PHP Object Injection CVSS 8.1 · 24.09.202504.08.20266.1TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting CVSS 6.1 · 04.08.202605.08.20267.2TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVSS 7.2 · 05.08.202618.08.20267.2TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 18.08.202619.08.20267.2TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 19.08.202624.08.20267.3TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Privilege Escalation CVSS 7.3 · 24.08.20266.4TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor CVSS 6.4 · 24.08.202625.08.20269.8TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure CVSS 9.8 · 25.08.202627.08.20267.2TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser CVSS 7.2 · 27.08.2026

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

13

Get automatic notifications for all TranslatePress – Translate Multilingual sites with AI Translation vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-19632

TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

Read the full analysis

Vulnerability Records

13 records
2026-08-27 14:13CVE-2026-76053
7.2
High
darooYes
2026-08-25 14:56CVE-2026-19632
9.8
Critical
Yuto HyakumotoYes
2026-08-24 19:07CVE-2026-18512
6.4
Medium
Yuto HyakumotoYes
2026-08-24 12:35CVE-2026-78267
7.3
High
ChuongVNYes
2026-08-19 00:00CVE-2026-66582
7.2
High
Quentin LamourYes
2026-08-18 18:23CVE-2026-75981
7.2
High
Pham Duc AnhYes
2026-08-05 17:09CVE-2026-18510
7.2
High
Pham Duc AnhYes
2026-08-04 18:24CVE-2026-17505
6.1
Medium
Yuto HyakumotoYes
2025-09-24 00:00CVE-2025-58592
8.1
High
Phat RiOYes
2025-03-27 00:00CVE-2025-30773
7.2
High
Ananda DhakalYes
Showing 1–10 of 13 reports
TranslatePress – Translate Multilingual sites with AI Translation banner
Latestv3.3.5

TranslatePress – Translate Multilingual sites with AI Translation

Cozmoslabs

Author

Cozmoslabs

4.7(1,654)
94/100
Last Updated
2026-09-08 (5d ago)
Active Installs
400,000+
Downloads
20,699,603
Requires WP
3.1.0+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2017-08-31 (9y ago)

Experience a better way to translate your WordPress site and go multilingual, directly from the front-end using a visual translation interface. The built-in AI translation lets you translate automatically, then refine anything visually. TranslatePress is a WordPress translation plugin that anyone can use. The interface allows you to easily translate the entire page at once, including output from shortcodes, forms and page builders. It also works out of the box with WooCommerce. Built the WordPress way, TranslatePress – Multilingual is a GPL and self hosted translation plugin, meaning you’ll own all your translations, forever. It’s the fastest way to create a bilingual or multilingual site. Multilingual & Translation Features Translate all your website content directly from the front-end, in a friendly user interface (translations are displayed in real-time). Fully compatible with all themes and plugins Live preview of your translated pages, as you edit them. Automatic AI translation support through TranslatePress AI Free, with a 2,000 AI words limit. Use our free Website Word Count to find how many words your website contains. Integrates with Google Translate, allowing you to set up unlimited automatic translations using your own Google API key. Fully customizable language switcher that you can display as a menu item, a floating dropdown, or place anywhere else using the Language Switcher block, or the [language-switcher] shortcode. Image translation support, for translating images, sliders and other media. Support for both manual and automatic translation Ability to translate dynamic strings (gettext) added by WordPress, plugins and themes. Translate larger html blocks by merging strings into translation blocks. Editorial control allowing you to publish your language only when all your translations are done Conditional display content shortcode based on language [trp_language language=”en_US”] English content only [/trp_language] Possibility to edit gettext strings from themes and plugins from English to English, without adding another language. Basically a string-replace functionality. Translate only certain paths and exclude content from being translated Translation Block feature in which you can translate multiple html elements together Native Gutenberg support, so you can easily translate Gutenberg blocks Out of the box WooCommerce compatibility Use our FREE Website Translation tool/widget to browse any website into your own language. Note: this plugin uses the Google Translation API to translate the strings on your site. This feature can be enabled or disabled according to your preferences. Users with administrator rights have access to the following settings: select default language of the website and one translation language, for bilingual sites choose whether language switcher should display languages in their native names or English name force custom links to open in current language enable or disable url subdirectory for the default language enable automatic translation via Google Translate Powerful Translation Add-ons TranslatePress – Multilingual has a range of premium Add-ons that allow you to extend the power of this WordPress translation plugin: Pro Add-ons (available in the premium versions only) Full TranslatePress AI access – automatically translate your entire website without extra platforms to sign up for, API keys, and additional translation costs. Each premium version includes a set number of AI translated words you can use to instantly translate your site, saving you both time and money. Extra Languages – allows you to add an unlimited number of translation languages, with the possibility to publish languages later after you complete the translation SEO Pack – lets you translate meta information (like page title, description, url slug, image alt tag, Twitter and Facebook Social Graph tags & more) for boosting your multilingual SEO and increase traffic. Works with all popular SEO plugins. Different Domain per Language – assign a different domain to each language you add (e.g. domain.de, domain.es) and improve international SEO by creating a fully local experience for your visitors Translator Accounts – create or allow existing users to translate the site without admin rights Browse as User Role – view and translate content that is visible only to a particular user role Navigation Based on Language – configure and display different menu items for different languages Automatic User Language Detection – redirect first time visitors to their preferred language based on their browser settings or IP address DeepL Automatic Translation – The DeepL Automatic Translation add-on lets you automatically translate your website through the DeepL API Keyboard Shortcuts CTRL ( ⌘ ) + S – Save translation for the currently editing strings CTRL ( ⌘ ) + ALT + Z – Discard all changes for the currently editing strings CTRL ( ⌘ ) + ALT + → (Right Arrow) – Navigate to next string CTRL ( ⌘ ) + ALT + ← (Left Arrow) – Navigate to previous string Website translatepress.com Documentation Visit TranslatePress WordPress Translation plugin documentation page Add-ons Add-ons Demo Site You can test out TranslatePress – Multilingual plugin by visiting our demo site External Services This plugin connects to the TranslatePress AI translation service to perform automatic translations. Data sent includes page text, license key, site URL, and language settings. This may be triggered by front-end page visits, not just admin actions. If you opt in, the plugin sends limited diagnostic and configuration data to Cozmoslabs.com to help improve the product. Terms & Conditions: https://translatepress.com/terms-conditions/ Privacy Policy: https://translatepress.com/privacy-policy/ If you choose to use Google Translate or DeepL as your translation engine and provide your own API key, content from your site will be sent to those services for translation. This may also be triggered by front-end page visits. Google Translate Terms of Service: https://cloud.google.com/terms/ Google Privacy Policy: https://policies.google.com/privacy DeepL Terms of Service: https://www.deepl.com/en/pro-license DeepL Privacy Policy: https://www.deepl.com/en/privacy The plugin requests translation files of other plugins hosted on WordPress.org. Select2: https://github.com/select2/select2

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C