cozmoslabs Vulnerabilities and Affected Products
Vulnerabilities associated with TranslatePress – Translate Multilingual sites with AI Translation.
Products
Clear product- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor11 vulnerabilities
- Paid Member Subscriptions10 vulnerabilities
- Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction7 vulnerabilities
- Profile Builder Pro6 vulnerabilities
- profile_builder6 vulnerabilities
- Profile Builder3 vulnerabilities
- paid_member_subscriptions2 vulnerabilities
- TranslatePress2 vulnerabilities
- TranslatePress – Translate Multilingual sites with AI Translation2 vulnerabilities
- User Profile Picture2 vulnerabilities
- WP Webhooks2 vulnerabilities
- Profile Builder – User Profile & User Registration Forms1 vulnerability
- Profile Builder – User Profile & User Registration Forms (WordPress plugin)1 vulnerability
- user_profile_picture1 vulnerability
- WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-18510HIGH | TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment ContentThe TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-tim… CWE-79Aug 6, 2026 | CVSS7.2v3.1 | EPSS0.243% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-17505MEDIUM | TranslatePress <= 3.2.5 - Reflected Cross-Site ScriptingThe Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input — allowing the attacker to bypass WordPress's normal HTML escapin… | CVSS6.1v3.1 | EPSS0.804% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |