Unauthenticated cross-site scripting in Cozmoslabs TranslatePress

Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

• The affected product is Cozmoslabs TranslatePress, the WordPress package translatepress-multilingual.
• Versions <= 3.3.2 are marked affected in the normalized record.
• Version 3.3.3 is marked unaffected in the status change and is listed by Patchstack as the patched version.
• The package default_status is unaffected, but that default does not override the explicitly affected version range above.

This is a CWE-79 flaw in which attacker-controlled input is not properly neutralized before it is used during TranslatePress web page generation. The supplied metadata indicates network reachability, no required authentication or privileges, low attack complexity, and required user interaction. At a high level, an attacker supplies crafted content to the affected functionality, that content is rendered into a web page, and a script may execute when a victim interacts with the page. The available evidence does not identify the parameter, endpoint, sink, rendering context, or whether the issue is reflected, stored, or DOM-based XSS. Scope is marked as changed, so the impact may extend beyond the vulnerable component, but the specific security boundary is not established.

• The attack path is network reachable and requires no authentication or privileges, but it does require user interaction and has low complexity.
• The normalized record sets public_exploit to false and leaves known_exploited unset.
• Patchstack's advisory page labels the issue “Known to be exploited (KEV)”.
• These statuses are inconsistent. No exploit code, campaign, victim, or specific indicator is provided, so exploitation should be treated as unresolved rather than definitively confirmed or ruled out.

The flaw may allow attacker-controlled script to execute in a user's browser after the user interacts with affected content. Potential consequences include reading data available to the browser context, changing rendered content, or performing actions as the victim. The supplied metadata marks scope as changed, so consequences may extend beyond the TranslatePress component, but the specific boundary is unknown. The actual outcome depends on the victim's privileges, the processed content, and the browser context; no specific compromise or data loss is established.

• An attacker may cause a script to run in a victim's browser under the security context of the affected site.
• Possible consequences include exposure of data available to that browser session, unauthorized actions, or manipulation of rendered content; these are potential technical outcomes, not confirmed incidents.
• Because the vulnerable path does not require authentication, internet-facing WordPress sites using the plugin should prioritize verification and updating, while the required user interaction limits automatic exploitation.
• No specific victim, campaign, successful compromise, data loss, or service outage is identified.

1. Update Cozmoslabs TranslatePress to version 3.3.3, which the record marks as unaffected.
2. The supplied solution recommends the latest available version, at least 3.3.3. For other release branches, verify that the particular release includes the fix rather than inferring coverage from the version number alone.
3. If an immediate update is not possible, apply Patchstack's mitigation rule where it is available. Treat this as a temporary control while completing the update.
4. After updating, recheck the actual plugin version on every production, staging, and replicated deployment, and confirm that the change is loaded and the vulnerable code is no longer being served.

1. Inventory all WordPress sites and identify deployments using the translatepress-multilingual package.
2. Compare each installed plugin version with the affected boundary in the record and confirm that the deployed version is outside that range.
3. Check plugin update status in every production and staging environment, including copies or temporary sites that may be missing from the primary inventory.
4. Review web server, WAF, and security telemetry for unusual requests or unexpected script activity involving pages rendered through TranslatePress. This is precautionary monitoring; the available sources do not provide a known IOC or log signature.
5. If users report unusual page content, browser behavior, account changes, or session anomalies after interacting with translated content, investigate those reports alongside request history and the installed plugin state. The absence of suspicious log evidence does not prove that a site is safe.