CVE-2026-107768Published

TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107768 · Microsoft / collected KEV context

cve-program · CVE-2026-107768

https://www.wordfence.com/threat-intel/vulnerabilities/id/5e9733d3-4097-4785-947c-db90a38795b3?source=cve
https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.7/includes/class-translation-render.php#L1355
https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.7/includes/class-translation-render.php#L835
https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.7/includes/class-translation-render.php#L1655
https://plugins.trac.wordpress.org/changeset/3744262/translatepress-multilingual/trunk/includes/class-translation-render.php

Related operational evidence

Explicit CVE identifiers

No related operational record is retained in the current change model.