CVE-2026-88784
CVE-2026-88784 · Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
CVSS 7.5 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
translate wordpress with weglot 2.0
- Versiones
- ≥ 0, < 6.4.3: Afectada (semver)
Actualiza a 6.4.3