Unrated severityNVD Advisory· Published Oct 3, 2026

CVE-2026-94239

Description

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

Affected products

WordPress/Loco Translatellm-fuzzy
Range: <2.8.9
Package: https://wordpress.org/plugins/loco-translate

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/6ab3ec44-cf3b-43ac-8c84-51291e9759dc/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000