CVE-2026-94239: Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

Q: Who can exploit this issue?

A user needs the WordPress translator capability or a higher privilege level. The stored script can then target higher-privileged users, including administrators, when they view the affected admin page.

Q: Are installations running the fixed release affected?

No. The issue affects Loco Translate versions before 2.8.9; version 2.8.9 is not described as vulnerable.

Q: Where should defenders look for signs of attempted exploitation?

Review bundle configuration values and the affected Loco Translate administrative page for unexpected or script-like content. Focus review on changes made by accounts holding the translator capability or greater privileges.

Published Oct 3, 2026

Updated

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

Affected Software

1 affected component

Loco Translate Loco Translate<2.8.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Loco Translate to a version that resolves this vulnerability.
Fixed in 2.8.9

Event History

Oct 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user needs the WordPress translator capability or a higher privilege level. The stored script can then target higher-privileged users, including administrators, when they view the affected admin page.

Are installations running the fixed release affected?

No. The issue affects Loco Translate versions before 2.8.9; version 2.8.9 is not described as vulnerable.

Where should defenders look for signs of attempted exploitation?

Review bundle configuration values and the affected Loco Translate administrative page for unexpected or script-like content. Focus review on changes made by accounts holding the translator capability or greater privileges.

CVE-2026-94239: Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are installations running the fixed release affected?

Where should defenders look for signs of attempted exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are installations running the fixed release affected?

Where should defenders look for signs of attempted exploitation?