CVE-2026-89412: stored XSS — HIGH

CISO Take

TranslatePress, a WordPress AI-translation plugin, has a stored cross-site scripting flaw in its Translation Memory suggestion panel (versions up to 3.3.5). An unauthenticated attacker can seed the translation dictionary with HTML that later executes in an administrator's session, which can lead to admin account takeover or site compromise. Exploitation likelihood is low for now: EPSS is 0.5% (top 57%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says TRACK. The AI-specific blast radius is limited, because this is a conventional web flaw in a translation plugin, not in a model or ML pipeline. The reference tags show the vulnerable code still present in 3.3.5, so confirm with the vendor whether a fixed release exists. Until then, restrict administrator access to the Translation Memory panel, tighten CSP, and review the translation dictionary for injected HTML.

Sources:NVDEPSSATLASCISA SSVCplugins.trac.wordpress.org

What is the risk?

Medium-high for affected WordPress sites, with a CVSS of 7.2 and a scope change. The attack is network-based, needs no privileges and low complexity, and the payload is stored. Exploitation probability is currently low (EPSS 0.005, no public exploit, not in KEV, SSVC TRACK). The main risk is script execution in an administrator's browser, which can lead to account takeover, malicious plugin installation or site defacement. The AI/ML-specific risk is minimal: the issue sits in the web UI layer, and only the AI translation feature's data flow is involved.

How does the attack unfold?

Initial Access

An unauthenticated attacker submits entity-encoded HTML through content processed by the front-end translation pipeline.

AML.T0049

Payload Persistence

The plugin decodes the payload with html_entity_decode() and stores it in the unfiltered original column of the translation dictionary.

Execution

An administrator opens the Translation Memory suggestion panel, and v-html renders the stored payload as executable script.

AML.T0078

Impact

The script runs with admin privileges, enabling account takeover, rogue admin creation or malicious plugin upload.

Initial Access

An unauthenticated attacker submits entity-encoded HTML through content processed by the front-end translation pipeline.

AML.T0049

Payload Persistence

The plugin decodes the payload with html_entity_decode() and stores it in the unfiltered original column of the translation dictionary.

Execution

An administrator opens the Translation Memory suggestion panel, and v-html renders the stored payload as executable script.

AML.T0078

Impact

The script runs with admin privileges, enabling account takeover, rogue admin creation or malicious plugin upload.

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Check the installed TranslatePress version and update as soon as the vendor ships a release newer than 3.3.5 that fixes the issue; the references show the vulnerable code in 3.3.5, so verify that the fix is present. 2) Until a fix is available, avoid opening the Translation Memory suggestion panel, or temporarily deactivate the plugin on high-value sites. 3) Audit the translation dictionary tables (original column) for script tags, event handlers and entity-encoded HTML, and remove suspicious entries. 4) Enforce a strict Content-Security-Policy that blocks inline scripts, and set HttpOnly and SameSite on session cookies. 5) Place a WAF rule in front of the site to flag entity-encoded script payloads in translatable page content. 6) Require MFA for administrators and review recent admin actions, new users and plugin installs for signs of compromise.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakagePluginFrameworkAML.T0049- Exploit Public-Facing Application AML.T0078- Drive-by Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-89412?

TranslatePress, a WordPress AI-translation plugin, has a stored cross-site scripting flaw in its Translation Memory suggestion panel (versions up to 3.3.5). An unauthenticated attacker can seed the translation dictionary with HTML that later executes in an administrator's session, which can lead to admin account takeover or site compromise. Exploitation likelihood is low for now: EPSS is 0.5% (top 57%), the CVE is not in CISA KEV, no public exploit or Nuclei template exists, and CISA SSVC says TRACK. The AI-specific blast radius is limited, because this is a conventional web flaw in a translation plugin, not in a model or ML pipeline. The reference tags show the vulnerable code still present in 3.3.5, so confirm with the vendor whether a fixed release exists. Until then, restrict administrator access to the Translation Memory panel, tighten CSP, and review the translation dictionary for injected HTML.

Is CVE-2026-89412 actively exploited?

No confirmed active exploitation of CVE-2026-89412 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-89412?

1) Check the installed TranslatePress version and update as soon as the vendor ships a release newer than 3.3.5 that fixes the issue; the references show the vulnerable code in 3.3.5, so verify that the fix is present. 2) Until a fix is available, avoid opening the Translation Memory suggestion panel, or temporarily deactivate the plugin on high-value sites. 3) Audit the translation dictionary tables (original column) for script tags, event handlers and entity-encoded HTML, and remove suspicious entries. 4) Enforce a strict Content-Security-Policy that blocks inline scripts, and set HttpOnly and SameSite on session cookies. 5) Place a WAF rule in front of the site to flag entity-encoded script payloads in translatable page content. 6) Require MFA for administrators and review recent admin actions, new users and plugin installs for signs of compromise.

What systems are affected by CVE-2026-89412?

This vulnerability affects the following AI/ML architecture patterns: WordPress AI translation plugins, Web-based ML management UIs, Multilingual content delivery sites.

What is the CVSS score for CVE-2026-89412?

CVE-2026-89412 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.53%.

What is the AI security impact?

Affected AI Architectures

WordPress AI translation pluginsWeb-based ML management UIsMultilingual content delivery sites

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0078Drive-by Compromise

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence, and the original column is deliberately exempt from kses filtering — meaning no save-time sanitizer neutralizes the stored payload before it is later rendered in an administrator's session.

Exploitation Scenario

An attacker visits a multilingual WordPress site and submits crafted, entity-encoded HTML (for example an encoded img tag with an onerror handler) through content that the front-end translation pipeline processes. The plugin decodes it with html_entity_decode() and stores it in the unfiltered original column of the translation dictionary. Later, an administrator opens the visual translation editor and the Translation Memory suggestion panel, which renders the stored string through v-html and runs the script in the admin's session. The script creates a rogue administrator account or uploads a malicious plugin, giving the attacker persistent control of the site.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.