EUVD-2026-91948
GHSA-xmgg-47vp-73xr
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Authenticated translator capability is low-privilege not admin (PR:L, vs input PR:H); admin must view the page (UI:R); XSS executes in victim's browser context (S:C) with limited direct C/I and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
AnalysisAI
Stored cross-site scripting in the Loco Translate WordPress plugin before 2.8.9 allows an authenticated attacker with the plugin's translator capability or higher to inject unsanitized bundle configuration values that are later rendered in an admin page, executing script in the browser of a high-privilege user such as an administrator who views that page. The vulnerability is tracked as CVE-2026-94239 and publicly available exploit code exists, though EPSS is low at 0.15% (4th percentile) and there is no CISA KEV confirmation of active exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an authenticated WordPress account that has been granted Loco Translate's 'translator' capability or higher - an administrator-assigned custom capability, not a default subscriber role - and (2) the ability to edit a translation bundle's configuration values, which are stored without sanitization/escaping. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-risk, authenticated stored XSS (CWE-79) that is a real but second-tier priority rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Loco Translate WordPress plugin to version 2.8.9 or later; the vendor-released patch is 2.8.9, per the vendor advisory and WPScan entry (https://wpscan.com/vulnerability/6ab3ec44-cf3b-43ac-8c84-51291e9759dc/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Loco Translate
View allPath traversal in Loco Translate WordPress plugin before 2.8.9 (CVSS 6.8) lets authenticated users who hold the plugin's
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source tran
Remote code execution in the Loco Translate WordPress plugin (all versions up to and including 2.8.5) is reachable throu
Stored XSS in the Loco Translate WordPress plugin (versions up to and including 2.8.7) allows authenticated users holdin
Reflected Cross-Site Scripting in Loco Translate WordPress plugin versions up to 2.8.2 allows unauthenticated attackers
Loco Translate plugin for WordPress versions up to 2.8.2 allows authenticated attackers with Translator-level access to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today