Vulnerabilities and security researches fortranslatepress-multilingual translatepress-multilingual

Jun 07, 2024

CVE, Research URL: CVE-2024-34827
Home page URL: Security reports for Translate Multilingual sites – TranslatePress
Application: Translate Multilingual sites – TranslatePress
Date: May 14, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hurduban TranslatePress.This issue affects TranslatePress: from n/a through 2.7.5.
Affected versions: max 2.7.6.
Status: vulnerable

CVE, Research URL: CVE-2021-24610
Home page URL: Security reports for Translate Multilingual sites – TranslatePress
Application: Translate Multilingual sites – TranslatePress
Date: Sep 27, 2021
Research Description: The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.
Affected versions: max 2.0.9.
Status: vulnerable

CVE, Research URL: CVE-2022-3141
Home page URL: Security reports for Translate Multilingual sites – TranslatePress
Application: Translate Multilingual sites – TranslatePress
Date: Sep 19, 2022
Research Description: The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.
Affected versions: max 2.3.3.
Status: vulnerable

Mar 28, 2025

CVE, Research URL: CVE-2025-30773
Home page URL: Security reports for Translate Multilingual sites – TranslatePress
Application: Translate Multilingual sites – TranslatePress
Date: Mar 27, 2025
Research Description: Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.
Affected versions: max 2.9.7.
Status: vulnerable

Nov 10, 2025

CVE, Research URL: CVE-2025-58592
Home page URL: Security reports for Translate Multilingual sites – TranslatePress
Application: Translate Multilingual sites – TranslatePress
Date: Nov 06, 2025
Research Description: Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.
Affected versions: max 2.10.3.
Status: vulnerable

Jul 28, 2026

PSC, Research URL: PSC-2026-64679
Home page URL: Security reports for Translate Multilingual sites – TranslatePress
Application: Translate Multilingual sites – TranslatePress
Date: Jul 28, 2026
Research Description: Multilingual plugins store translated text and insert it into front-end output across themes and other plugins. Visual editing, language routing, and automatic translation features require firm access controls and consistent escaping. TranslatePress - Translate Multilingual sites with AI Translation version 3.2.6 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64679, confirming that the plugin was reviewed from a secure code perspective with attention to translation storage, visual editor permissions, multilingual routing, automatic translation settings, and public output.
Affected versions: Min 3.2.6, max 3.2.6.
Status: SAFE & CERTIFIED