CVE-2026-94239

Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

Affected

Loco Translate

CVSS v3.1 CNA

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 13th percentile

Published

2026-10-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6ab3ec44-cf3b-43ac-8c84-51291e9759dc/

References

• CVE Record
• NVD entry