Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Loco Translate 2.8.9 Clear all filters
TI-2026-67443 CVE-2026-94239 · GHSA-xmgg-47vp-73xr

Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

Priority LOW 31

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perf…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00229 Published 2026-10-03 Fixed in 2.8.9 CWE-79
TI-2026-67442 CVE-2026-94238 · GHSA-m23q-3295-mh2g

Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter

Priority LOW 30

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability t…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00316 Published 2026-10-03 Fixed in 2.8.9 CWE-22