PO/MO Editor CVE-2026-97020

Requires the PO/MO Editor plugin (≤1.4.2) installed and active, plus a valid authenticated account with subscriber-level capability or higher (CVSS PR:L) - realistic on sites with open user registration enabled. Exploitation occurs through the 'podata' parameter, which lacks input sanitization and output escaping; the stored payload is injected as a replacement .po/.mo translation file and executed via the plugin's load_textdomain_mofile filter when any user renders an affected page. Limiting factors: an attacker must first obtain a low-privilege account (not anonymous/unauthenticated), the vulnerable plugin must be present, and impact (C:L/I:L, no availability effect) is bounded to script execution in victim browsers rather than direct server compromise.

This is a medium-severity stored XSS (CVSS 6.4, CWE-79) reported by Wordfence, a credible WordPress-vulnerability source. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring only low privileges (PR:L) and no user interaction to inject, with a scope change (S:C) reflecting that the stored payload executes in other users' browser contexts. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability and real-world activity cannot be quantified from available signals - exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent and not conflicting: a genuinely low-barrier flaw (subscriber-level accounts are common on open-registration WordPress sites) but with only Low confidentiality/integrity impact and no availability impact. The notable technical twist - the payload is served as a replacement core translation file via the plugin's own load_textdomain_mofile filter - broadens blast radius because poisoned strings render across arbitrary pages, which supports the S:C scope rating. Overall this is a real but moderate priority: prioritize where the PO/MO Editor plugin is installed and user self-registration is enabled; deprioritize on locked-down single-admin sites where no low-privilege accounts exist. Absence of KEV/EPSS/POC here means lack of evidence, not evidence of low risk - verify against a live feed before final triage.

An attacker registers or obtains a subscriber-level account on a WordPress site running PO/MO Editor ≤1.4.2 and submits a crafted 'podata' parameter containing a malicious translation entry. The plugin stores this as a .po/.mo file and, via its load_textdomain_mofile filter, serves the attacker-controlled translation in place of legitimate core strings, so the injected script executes in the browser of any user - including an administrator - who subsequently loads an affected page. No public exploit code was identified in the provided data, and no user interaction is required to plant the payload.