What is the CVSS score of EUVD-2026-59864?

EUVD-2026-59864 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Loco Translate EUVD-2026-59864

| CVE-2026-15066 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-16 Wordfence

GHSA-2cg4-q2f7-q8x7

WordPress XSS Loco Translate Wordpress Plugin Timwhitlock

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS payload fires only when a victim loads the page (UI:R); a translator credential is required (PR:L); scope change confirmed as execution occurs in victim's browser context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 05:09 vuln.today

CVE Published

Aug 16, 2026 - 04:24 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in the Loco Translate WordPress plugin (versions up to and including 2.8.7) allows authenticated users holding the translator role or above to inject persistent malicious scripts via crafted PO file extracted comments. When an affected translation page is subsequently loaded by another authenticated user - including site administrators - the stored payload executes in that user's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix commit is confirmed in the WordPress plugin trac repository, and the Wordfence advisory provides the authoritative disclosure record.

Technical ContextAI

Loco Translate (CPE: cpe:2.3:a:timwhitlock:loco_translate) is a WordPress plugin for managing GNU gettext PO and MO translation files directly within the WordPress admin interface. PO files support 'extracted comments' - lines prefixed with #. - that source-code parsers insert to provide translators with context about where a string is used. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) is that the plugin's server-side save handler (SaveController.php at line 52) stores extracted comments in the database without sanitizing HTML metacharacters, and the admin-side JavaScript renderer (admin.js at lines 1404 and 3533, present identically in versions 2.8.4 and 2.8.5) outputs those stored values to the DOM without escaping, completing the stored-XSS sink. The flaw spans both the ingestion path (PHP) and the rendering path (JavaScript), indicating the absence of defence-in-depth sanitization at either layer.

RemediationAI

The primary fix is to upgrade Loco Translate to the version that incorporates changeset 3631056, referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3631056%40loco-translate&new=3631056%40loco-translate; the exact version tag of the released patch is not stated in the available input data, so administrators should verify the current stable release in the WordPress plugin repository and confirm it is numbered above 2.8.7. If an immediate upgrade is not feasible, the most targeted compensating control is to audit all accounts holding the translator role and revoke that grant from any user who does not strictly require it, since the vulnerability is gated on translator-level authentication - reducing the pool of accounts capable of injecting payloads directly reduces exposure. As a secondary layer, restricting access to the WordPress admin interface to known trusted IP ranges via server-level allow/deny rules or a WAF policy will limit the attack surface, at the operational cost of blocking legitimate remote translators who work outside those ranges.