EUVD-2026-59864
GHSA-2cg4-q2f7-q8x7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS payload fires only when a victim loads the page (UI:R); a translator credential is required (PR:L); scope change confirmed as execution occurs in victim's browser context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored XSS in the Loco Translate WordPress plugin (versions up to and including 2.8.7) allows authenticated users holding the translator role or above to inject persistent malicious scripts via crafted PO file extracted comments. When an affected translation page is subsequently loaded by another authenticated user - including site administrators - the stored payload executes in that user's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active, authenticated WordPress user account holding at minimum the translator role as defined by the Loco Translate plugin - unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.4 score captures the core tension of this vulnerability: the attack is network-accessible with low complexity and requires only a low-privilege (translator) credential, but exploitation is bounded by that authentication requirement and produces only limited confidentiality and integrity impact per victim session. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade Loco Translate to the version that incorporates changeset 3631056, referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3631056%40loco-translate&new=3631056%40loco-translate; the exact version tag of the released patch is not stated in the available input data, so administrators should verify the current stable release in the WordPress plugin repository and confirm it is numbered above 2.8.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Loco Translate
View allThe Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source tran
Remote code execution in the Loco Translate WordPress plugin (all versions up to and including 2.8.5) is reachable throu
Reflected Cross-Site Scripting in Loco Translate WordPress plugin versions up to 2.8.2 allows unauthenticated attackers
Loco Translate plugin for WordPress versions up to 2.8.2 allows authenticated attackers with Translator-level access to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today