CVE-2026-94239
Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
| Vendor | unknown |
| Product | loco translate |
| Published | Oct 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown loco translate
Be the first to know when new unknown vulnerabilities affecting unknown loco translate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Loco Translate
0 < 2.8.9
References
Credits
Het Kalariya WPScan