Plugin vulnerabilities
Is TranslatePress safe? Known vulnerabilities and the version to run.
TranslatePress: translates a site from the front end, with manual or automatic translations.
The short answer
Run TranslatePress 3.3.9 or later. That version has a fix for every known vulnerability that's been patched.
- Known vulnerabilities
- 19
- In the last 12 months
- 14
- Rated high or critical
- 15
- No fix yet
- 0
Every known TranslatePress vulnerability
Newest first. The most recent was disclosed on 7 November 2026. Each one links to its full record on Wordfence.
| Vulnerability | Severity | Affected versions | Fixed in |
|---|---|---|---|
| Unauthenticated Stored Cross-Site ScriptingCVE-2026-121765 · 7 November 2026 | High 7.2 | 3.3.8 and earlier | 3.3.9 |
| Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack BypassCVE-2026-119167 · 6 November 2026 | High 7.2 | 3.3.8 and earlier | 3.3.9 |
| Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary EndpointCVE-2026-120537 · 6 November 2026 | High 7.2 | 3.3.8 and earlier | 3.3.9 |
| Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED MarkersCVE-2026-107768 · 15 October 2026 | High 7.2 | 3.3.7 and earlier | 3.3.8 |
| Unauthenticated Stored Cross-Site ScriptingCVE-2026-103062 · 2 October 2026 | High 7.2 | 3.3.6 and earlier | 3.3.7 |
| Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion PanelCVE-2026-89412 · 21 September 2026 | High 7.2 | 3.3.5 and earlier | 3.3.6 |
| Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML ParserCVE-2026-76053 · 27 August 2026 | High 7.2 | 3.3.3 and earlier | 3.3.4 |
| Unauthenticated Account Takeover via Password Reset Link DisclosureCVE-2026-19632 · 25 August 2026 | Critical 9.8 | 3.3.1 and earlier | 3.3.2 |
| Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation EditorCVE-2026-18512 · 24 August 2026 | Medium 6.4 | 3.2.6 and earlier | 3.3 |
| Unauthenticated Privilege EscalationCVE-2026-78267 · 24 August 2026 | High 7.3 | 3.3.2 and earlier | 3.3.3 |
| Unauthenticated Stored Cross-Site ScriptingCVE-2026-66582 · 19 August 2026 | High 7.2 | 3.3.2 and earlier | 3.3.3 |
| Unauthenticated Stored Cross-Site ScriptingCVE-2026-75981 · 18 August 2026 | High 7.2 | 3.2.5 and earlier | 3.2.6 |
| Unauthenticated Stored Cross-Site Scripting via Comment ContentCVE-2026-18510 · 5 August 2026 | High 7.2 | 3.2.6 and earlier | 3.3 |
| Reflected Cross-Site ScriptingCVE-2026-17505 · 4 August 2026 | Medium 6.1 | 3.2.5 and earlier | 3.2.6 |
| Unauthenticated PHP Object InjectionCVE-2025-58592 · 24 September 2025 | High 8.1 | 2.10.2 and earlier | 2.10.3 |
| Authenticated (Administrator+) PHP Object InjectionCVE-2025-30773 · 27 March 2025 | High 7.2 | 2.9.6 and earlier | 2.9.7 |
| Cross-Site Request ForgeryCVE-2024-34827 · 9 May 2024 | Medium 4.3 | 2.7.5 and earlier | 2.7.6 |
| Authenticated (Administrator+) SQL InjectionCVE-2022-3141 · 23 July 2022 | High 7.2 | 2.3.2 and earlier | 2.3.3 |
| Authenticated Stored Cross-Site ScriptingCVE-2021-24610 · 30 August 2021 | Medium 4.8 | before 2.0.9 | 2.0.9 |
If you run TranslatePress
What to do now
- Check your version. In WordPress, go to Plugins and look under TranslatePress. Compare it with the affected versions above.
- Update to 3.3.9 or later. Take a backup first, then update. If the update breaks something, you can restore the backup while you work out why.
- Check the rest of your site. One outdated plugin is rarely the only one. Our free security check looks at your WordPress version, and the plugins and theme it can see from the outside, for known flaws and emails you a report.
Pressfort keeps your plugins up to date for you, testing each update on a copy of your site first, and its virtual patching blocks attacks on newly disclosed flaws, often before a fix is out. If your site does get hacked, two clean-ups a year are included, with a developer stepping in when needed. See how it works.
Content and custom fields
Related plugins
Duplicate Page
Copies posts, pages and custom post types with one click.
3 known
Yoast Duplicate Post
Copies posts and pages so you can reuse or rework them, including a rewrite-and-republish option.
5 known2 in the last year
ACF
A plugin for adding custom fields to posts, pages and other content.
28 known7 in the last year
Custom Post Type UI
Creates custom post types and taxonomies without writing code.
4 known2 in the last year
Safe SVG
Lets you upload SVG images, cleaning them first to remove harmful code.
8 known2 in the last year
Polylang
Makes a WordPress site multilingual, with each translation as its own post or page.
8 known5 in the last year
Data sources and licences
Vulnerability data comes from Wordfence Intelligence and is refreshed daily. Severity is the CVSS score given in each record. Pressfort is not affiliated with Wordfence or Defiant Inc.
Copyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Not sure yet?
Find out how exposed your site is.
Send us your site address and get a free, plain-English report of what we find. We check from the outside, so there are no logins to hand over and nothing to install.
- Known vulnerability in 1 pluginGallery plugin, file upload flawUrgent
- WordPress is out of dateRunning 6.7.1, latest is 6.8.3To fix
- 6 plugins and 1 theme out of dateOldest is 14 months behindTo fix