CVE-2026-88784
Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
| Vendor | unknown |
| Product | translate wordpress with weglot 2.0 |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown translate wordpress with weglot 2.0
Be the first to know when new unknown vulnerabilities affecting unknown translate wordpress with weglot 2.0 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Translate WordPress with Weglot 2.0
0 < 6.4.3
References
Credits
Jakub Herman WPScan