WordPress Loco Translate < 2.6.1 - Cross-Site Scripting

Loco Translate WordPress plugin before 2.6.1 contains a stored cross-site scripting vulnerability caused by improper removal of inline events from source translation strings, allowing authenticated users to inject arbitrary JavaScript payloads. id: CVE-2022-0765 info: name: WordPress Loco Transla...

CVE-2026-106369

Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

EUVD-2026-93805

Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-106369

Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

CVE-2026-106369

A missing authorization vulnerability in the Translate functionality of Google Chrome (versions prior to 155.0.8059.39) allows a remote attacker who has already compromised the renderer process to bypass site isolation using a crafted HTML page. The vulnerability is classified with a High securit...

CVE-2025-67886

CVE-2025-67886 Bitrix24 = 25.100.300 Translate Module Vulnerabilidad de ejecución remota de código...

CVE-2026-94239

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

CVE-2026-94238

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server...

EUVD-2026-91947

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server...

CVE-2026-94239 Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

CVE-2026-94238 Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server...

CVE-2026-94238 Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server...

CVE-2026-94239 Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

CVE-2026-94238

The Loco Translate WordPress plugin versions prior to 2.8.9 is vulnerable to a Path Traversal flaw (CWE-22) because it fails to restrict file paths used by its translation file routes. An attacker with the translator capability can exploit this to retrieve the contents of various file types from ...

EUVD-2026-91948

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

CVE-2026-94239

The Loco Translate WordPress plugin, in versions prior to 2.8.9 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain bundle configuration values before they are rendered on an admin page. An attacker with translator capabilit...

PT-2026-104533

Name of the Vulnerable Software and Affected Versions Loco Translate WordPress plugin versions prior to 2.8.9 Description Insufficient restriction of file paths within translation file routes allows users with translator capabilities to retrieve the contents of specific file types from any locati...

PT-2026-104534

Name of the Vulnerable Software and Affected Versions Loco Translate WordPress plugin versions prior to 2.8.9 Description Insufficient sanitization and escaping of bundle configuration values before they are output on an admin page allows users with translator capabilities or higher to execute...

CVE-2026-94238: Improper Limitation of a Pathname to a Restricted Directory

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server...

CVE-2026-94239: Improper Neutralization of Input During Web Page Generation

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...