TranslatePress Stored XSS in Multilingual Content Handling

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

TranslatePress, a WordPress plugin for managing multilingual websites, contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions through 3.3.6. This CWE-79 weakness allows attackers to inject malicious scripts into web pages that persist in the application's database, executing in the browsers of all users who view the compromised content. The vulnerability is particularly dangerous because it targets content management workflows—attackers can inject payloads through translation features that remain stored and execute repeatedly. Organizations running affected TranslatePress versions, especially those managing multi-language WordPress sites with user-generated or admin-managed translations, face risks of credential theft, session hijacking, and malware distribution through their own trusted domains.

Casky's 323 matching security skills leverage Claude AI's extended reasoning to detect attack patterns across TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques. Practitioners using Casky would observe detection signals for: (1) anomalous input patterns in translation fields containing script tags, event handlers, or HTML entities designed to bypass sanitization; (2) reconnaissance activity where attackers probe the TranslatePress API endpoints to identify injectable parameters; (3) persistence indicators showing stored payloads in the WordPress database across multiple language variants. The platform's skill mapping would flag improper input neutralization in form handlers, missing output encoding in rendered translation strings, and insufficient Content Security Policy headers—enabling practitioners to distinguish legitimate translation operations from exploitation attempts and prioritize patching or implementing Web Application Firewall rules to neutralize injected content before database storage.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-103062.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-103062

Casky has 323 skills that investigate the attack patterns behind CVE-2026-103062. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn