What is the CVSS score of CVE-2026-4146?

CVE-2026-4146 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Loco Translate CVE-2026-4146

EUVD-2026-17325 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 Wordfence

WordPress XSS Loco Translate Wordpress Plugin Timwhitlock

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 05:15 euvd

EUVD-2026-17325

Analysis Generated

Mar 31, 2026 - 05:15 vuln.today

CVE Published

Mar 31, 2026 - 04:25 nvd

MEDIUM 6.1

DescriptionCVE.org

The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_href’ parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in Loco Translate WordPress plugin versions up to 2.8.2 allows unauthenticated attackers to inject arbitrary web scripts via the 'update_href' parameter due to insufficient input sanitization and output escaping. The vulnerability requires user interaction (clicking a malicious link) to execute, affecting WordPress sites with the plugin installed. CVSS 6.1 reflects moderate severity with network-accessible attack vector and cross-site scope impact on confidentiality and integrity.

Technical ContextAI

The Loco Translate plugin (timwhitlock:loco_translate) processes the 'update_href' parameter without adequate sanitization or HTML entity encoding before rendering it in page output. This is a classic Reflected XSS vulnerability (CWE-79) where attacker-controlled input is echoed back to the user's browser without proper escaping, allowing execution of arbitrary JavaScript in the context of the WordPress admin or front-end session. The vulnerability exists in template rendering code where user input flows directly into HTML attributes or content without WordPress escaping functions like esc_attr() or esc_url().

RemediationAI

Update Loco Translate plugin to version 2.8.3 or later, which includes fixes for input sanitization and output escaping in the affected parameters. Administrators should immediately upgrade via the WordPress plugin dashboard or manually download the patched version from https://plugins.trac.wordpress.org/. As an interim mitigation, restrict plugin access to trusted administrators only and review server access logs for evidence of XSS exploitation attempts. The plugin changeset 3482475 (referenced at https://plugins.trac.wordpress.org/changeset/3482475/loco-translate) details the security fixes applied.