rootpwn

high · CVSS v3 6.8 · EPSS 0.00152

CVE-2026-94239

The Loco Translate WordPress plugin (before v2.8.9) fails to sanitize bundle configuration values, enabling stored XSS via the admin interfa

Overview

The Loco Translate WordPress plugin (before v2.8.9) fails to sanitize bundle configuration values, enabling stored XSS via the admin interface. Attackers with translator or higher roles can inject malicious scripts that execute in the browsers of privileged users such as administrators. This flaw allows attackers to steal session cookies, deface content, or perform further privilege escalation.

Description

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

Impact

Confidentiality: attackers can exfiltrate sensitive data from admin sessions. Integrity: malicious scripts can modify or delete content. Availability: repeated XSS can degrade user experience. The primary impact is on administrators and other high‑privilege users who view the vulnerable admin page.

Remediation

Update Loco Translate to version 2.8.9 or later, which sanitises bundle configuration values. If an update is not immediately possible, remove the translator capability from all non‑trusted users or restrict access to the affected admin page. Verify that the plugin’s output is properly escaped before rendering.

Risk context

Severity is high with a CVSS v3 score of 6.8 and an EPSS of 0.00152, indicating a low probability of exploitation but significant impact if triggered. Defenders should prioritize patching or mitigating the vulnerability promptly.

Affected products

  • WordPress Loco Translate

Scores

Severity
high
CVSS v2
8.3
CVSS v3
6.8
CVSS v4
—
EPSS
0.00152

wordpress plugin xss stored admin high-privilege cve-2026-94239

← All CVEs

Related CVEs

high

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin (v<2.9.3) fails to validate URI schemes in user-supplied link targets, enabling stored XSS. Contributors and higher can inject malicious payloads that execute in the browsers of anyone who clicks the link, including administrators previewing drafts. This flaw can lead to session hijacking or defacement.

View analysis

high

CVE-2026-97935

A use‑after‑free bug in the Linux kernel tracing subsystem allows a malformed histogram trigger to corrupt the named_triggers list. The flaw occurs when an invalid clock string is supplied, causing the trigger to be registered before the clock is validated. This can lead to kernel memory corruption and potential privilege escalation.

View analysis

high

CVE-2026-104912

MISP before v2.5.48 has an authorization flaw in correlation handling during attribute searches. Correlated attributes and events can be authorized using a stale distribution snapshot instead of the live event access control list. This matters because restricted or unpublished events may remain visible to authenticated users who no longer have permission.

View analysis

high

CVE-2026-94544

CVE-2026-94544 exposes a cache sharing flaw in Next.js 16.3.0‑16.3.8 that allows unauthenticated users to see unpublished draft content or see published content in draft mode. The vulnerability arises when Cache Components or experimental.useCache are enabled and cached functions return draft‑dependent data. It can lead to accidental disclosure of sensitive content on public sites.

View analysis