CVE-2026-94239

MediumCVSS 6.8

Published: 03/10/2026(UTC)Updated: 03/10/2026(UTC)Translated: 03/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page. This allows users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

Risk Assessment

A stored XSS attack can lead to admin session hijacking, content modification, or malware installation. It requires a translator-capable account, which limits the pool of potential attackers.

Recommendation

Update the Loco Translate plugin to version 2.8.9 or later. Limit the number of users with the translator capability to the necessary minimum.

Other vulnerabilities in Loco Translate WordPress plugin

CVE-2026-94238Medium
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read. This allows users granted the translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

Original NVD description (English source)

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS