Weglot WordPress CVE-2026-88784

Exploitation requires the site to be running the Translate WordPress with Weglot 2.0 plugin (before 6.4.3) with at least one additional translated language configured and the link-rewriting/translation rendering feature active - the flaw only triggers when the plugin re-inserts and rewrites URLs for a translated-language view. The specific prerequisite from the description is that the plugin does not escape re-inserted URLs AND reverses their prior encoding during link rewriting, so the stored payload only fires when a victim loads the page in a translated language. Limiting factors: required user interaction (a victim must view the translated version of the page, UI:R), high attack complexity (AC:H) reflecting the non-trivial encoding-reversal condition, and impact confined to the browser context of whoever views the page. No authentication is needed to plant the payload (PR:N).

This is a genuine but moderate-priority issue rather than a critical fire-drill. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R) describes an unauthenticated, network-reachable stored XSS that nonetheless requires both high attack complexity and victim interaction (viewing a page in a translated language), which meaningfully constrains reliable exploitation. The C:H/I:H/A:H impact metrics assigned upstream (WPScan) are aggressive for a browser-context XSS and appear inflated - a client-side script-injection flaw does not realistically yield full confidentiality/integrity/availability loss of the server, so the real-world technical impact is better characterized as limited browser-side script execution (session theft, defacement, admin action forgery if an admin views the page). Exploitation signals are mixed-to-moderate: publicly available exploit code exists (WPScan), which raises accessibility, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - treat this as a patch-in-normal-cycle item unless an administrator-facing page is the injection target. Note the tension: PR:N (unauthenticated store) combined with AC:H means anyone can plant the payload, but it only fires under the specific translated-rendering condition, pointing to opportunistic rather than mass exploitation. No EPSS or SSVC data was supplied - risk ranking below the CVSS headline should be verified against the vendor advisory.

An unauthenticated attacker submits a crafted URL into content (e.g. a comment, profile, or other field re-inserted as a link) that the Weglot plugin later rewrites for a translated language; because the plugin fails to escape the re-inserted URL and reverses the prior encoding, the payload is stored and rendered as live markup. When any visitor - potentially a logged-in administrator - views the affected page in a translated language, the script executes in their browser, enabling session hijacking or actions on their behalf. Public exploit code from WPScan lowers the barrier to reproducing this, though the high attack complexity and required victim view limit reliability.