PT-2026-120484

CVE-2026-88784

Published

2026-10-21

Updated

2026-10-21

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Translate WordPress with Weglot 2.0 versions prior to 6.4.3

Description An issue exists where the plugin fails to escape URLs when rewriting links for a translated language and reverses the previously applied encoding. This allows unauthenticated users to store a malicious payload that executes in the browser of any user viewing the page in a translated language, resulting in Stored Cross-Site Scripting (XSS), a technique where a script is permanently stored on the target server.

Recommendations Update Translate WordPress with Weglot 2.0 to version 6.4.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers