rootpwn

high · CVSS v3 7.2 · EPSS 0.00236

CVE-2026-96575

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to stored XSS via comment content due

Overview

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to stored XSS via comment content due to a predictable placeholder. Attackers can inject scripts that execute for any user viewing the comment, potentially compromising site integrity. This flaw affects all WordPress sites using the plugin up to version 2.5.8.

Description

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives WordPress comment save-time sanitization because the tags and attributes used (such as a[title] and code) are permitted by the core comment kses allow-list, and the literal characters comprising the plugin's shortcode markers and placeholder tokens are not stripped.

Impact

Confidentiality: injected scripts can exfiltrate user data. Integrity: malicious code can alter page content. Availability: no direct impact. Defenders: site administrators and security teams must address the issue.

Remediation

Update the Transliterator plugin to version 2.5.9 or later. If an update is not feasible, disable comment functionality or implement stricter comment sanitization to strip disallowed tags. Monitor comment sections for suspicious activity and apply site-wide content security policies.

Risk context

Severity is high with a CVSS v3 score of 7.2 and an EPSS of 0.00236, indicating a low probability but high impact. Defenders should prioritize patching promptly to mitigate potential exploitation.

Affected products

  • WordPress Transliterator plugin
  • WordPress 6.x
  • WordPress 5.x

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.2
CVSS v4
—
EPSS
0.00236

XSS WordPress Stored XSS Plugin Vulnerability Comment Injection High Severity

← All CVEs

Related CVEs

high

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin (v<2.9.3) fails to validate URI schemes in user-supplied link targets, enabling stored XSS. Contributors and higher can inject malicious payloads that execute in the browsers of anyone who clicks the link, including administrators previewing drafts. This flaw can lead to session hijacking or defacement.

View analysis

high

CVE-2026-97935

A use‑after‑free bug in the Linux kernel tracing subsystem allows a malformed histogram trigger to corrupt the named_triggers list. The flaw occurs when an invalid clock string is supplied, causing the trigger to be registered before the clock is validated. This can lead to kernel memory corruption and potential privilege escalation.

View analysis

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis