Stored XSS via gettext marker rewrite

Stored XSS in Cozmoslabs TranslatePress before 3.2.6 allows remote attackers to execute JavaScript in visitors' browsers via comments. In includes/class-translation-render.php, translate_page() blindly rewrites the plaintext gettext markers #!trpst# and #!trpen# into angle brackets after WordPress sanitization, and remove_tags_from_output() strips only script and style tags, leaving an injected img onerror handler executable. Exposure requires attacker-controlled comment content to be rendered on a translated page in a secondary language; the consequence is script execution in other users' browser sessions rather than direct server-side compromise.