CVE-2026-88784
CVE-2026-88784 · Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
CVSS 7.5 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
translate wordpress with weglot 2.0
- Versions
- ≥ 0, < 6.4.3: Affected (semver)
Update to 6.4.3