CVE-2022-3141: Cozmoslabs Translatepress

High severity, CVSS 8.8. EPSS: 5.2% chance of exploitation in the next 30 days.

The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

Affected products

• Cozmoslabs Translatepress: before 2.3.3 (fixed in 2.3.3)

Published 2022-09-19. Last modified 2026-06-17.