Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting via Project File Prefix
- ID
- WPSEC-2026-0044
- Plugin
- Loco Translate (loco-translate)
- Affected
- all versions before 2.8.9
- Remediation
- Update to 2.8.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Loco Translate on WPSec AttackSurface
- Fix released
- Published
Description
The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the translation file path placeholder on the 'New language' and 'Upload' screens in all versions up to, and including, 2.8.8. The placeholder is built from the project's file prefix (slug), which can be set in a bundle's advanced configuration, and was output without escaping. This makes it possible for authenticated attackers with access to Loco Translate (any role an administrator grants the loco_admin capability, such as the plugin's Translator role) to save a file prefix containing arbitrary web scripts that execute when an administrator opens either screen for that plugin or theme.
References
- https://wpsec.com/vuln/WPSEC-2026-0044/
- https://plugins.svn.wordpress.org/loco-translate/tags/2.8.9/
- https://wordpress.org/plugins/loco-translate/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS