CVE-2026-17505

TranslatePress contains a reflected XSS vulnerability in how it reconstructs translatable strings during page rendering. The plugin uses marker tokens (#!trpst# and #!trpen#) to delimit strings needing translation. These tokens pass through WordPress's escaping functions unchanged because they contain no HTML special characters — they arrive at the translate_page() function as plain text. The function then expands these markers into angle brackets, reconstructing HTML that WordPress already cleared as safe but which now contains attacker-controlled content from the 's' search parameter. This is not a simple missing escape. The vulnerability is architectural: TranslatePress operates in a security context that WordPress's sanitization pipeline cannot see. The translate_page() function essentially reinterprets already-escaped output as raw HTML and rebuilds it. Any parameter reaching that reconstruction point becomes an XSS vector. The practical impact depends on your configuration. TranslatePress reports over 500,000 active installs. Not all expose the search feature publicly, and exploitation requires tricking a user into clicking a crafted link — a narrower attack surface than stored XSS with no user interaction. However, the marker infrastructure remains load-bearing code. Once shipped, every future parameter touching translate_page() inherits this vulnerability class. Expect surgical patches (an esc_html() call on specific parameters) rather than architectural fixes. What you should do: Audit which parameters on your site reach translate_page(), particularly search and query-string-driven content. Consider disabling translation on high-risk inputs until a patch arrives. If you maintain plugins that hook into post-translation output, treat that output as untrusted — the TranslatePress pipeline does not guarantee sanitized output. The patch will fix the 's' parameter; the architecture that guarantees future similar bugs will remain.

Reviewed through automated stages and approved by a human before publication.