TranslatePress < 3.3 - Unauthenticated Stored XSS via Comment Content

Description

The plugin is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified.