wpLingua 3.2.0 Fixes Unauthenticated Stored XSS: Forged Parser Placeholders in Comments Broke Out of HTML Attributes

The wpLingua plugin for WordPress ("Translate and boost SEO – Automatic AI translation") has fixed an unauthenticated stored cross-site scripting flaw that affects all versions up to and including 3.1.1. The fix shipped in 3.2.0 on November 9, 2026, and the advisory (WPSEC-2026-2763) was published on November 10.

How the bug works

wpLingua re-renders each page in the visitor's chosen language. To do that safely, its bundled HTML DOM parser temporarily swaps out the contents of <script>, <style> and <code> elements and HTML comments, replacing each one with a predictable placeholder key of the form ___noise___ NNNN. After translation, it puts the original content back.

The problem is the restore step. The parser restores any matching key it finds, including keys that appear inside attribute values, and it does so without escaping. That gives an attacker a simple trick:

1. Leave a comment containing markup that WordPress allows in comments, with a forged ___noise___ key placed inside an attribute.
2. Make sure content they control appears elsewhere on the page in a spot the parser swaps out, such as an HTML comment or a <code> element.
3. When the translated page is rendered, the parser drops that content into the attribute, where it breaks out of the quotes and becomes live markup.

No account is needed, and the injected script runs for every visitor who opens the translated version of the page, administrators included.

Severity

The advisory's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, a High score of 7.2, typical for unauthenticated stored XSS. WPSec rates both plugin usage and the share of sites on affected versions as low among the sites it scans, so this is not a mass-exposure event, but sites that do run wpLingua with open comments are directly in scope.

What to do

• Update wpLingua to 3.2.0 or later.
• If you can't update right away, consider closing or holding comments for moderation on translated pages until you can.
• Review recent comments for unusual markup or strings containing ___noise___.

The wider lesson

Placeholder-and-restore is a common pattern in translation, caching and minification plugins. Any time a plugin swaps content for a token and swaps it back later, the restore has to be limited to the places the plugin itself created, and the output has to be escaped for its context. Treating every matching string as trusted is exactly what turned a harmless comment into script injection here.

If you run an older WordPress or PHP stack where plugins can't be updated cleanly, RescuePHP can help audit third-party plugins, apply or backport security fixes, and plan a safe upgrade path.

Sources: WPSec advisory WPSEC-2026-2763, wpLingua on WordPress.org