Description

The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-16T05:16:46.880Z",
  "pubdate": "2026-08-16T05:16:46.880Z",
  "executiveSummary": "The Loco Translate plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability affecting all versions up to, and including, 2.8.7. This security flaw stems from inadequate input sanitization and improper output escaping applied to PO File Extracted Comments. The vulnerability poses significant risk by allowing authenticated malicious actors possessing translator-level access privileges or higher to inject arbitrary web scripts into application pages. When targeted users access the compromised pages, the injected scripts execute within the context of their active browser sessions. This compromise can lead to unauthorized actions, session hijacking, or further administrative abuse within the WordPress environment, thereby undermining the integrity and confidentiality of the affected web application.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Loco Translate plugin to sufficiently sanitize user-supplied input derived from PO File Extracted Comments and properly encode output before rendering it to the DOM. The vulnerable component processes localization translation files where metadata, specifically extracted comments, are parsed and displayed within the administrative interface.\nExploitation requires authenticated access with translator-level privileges or higher. An attacker leverages this access to upload or modify a maliciously crafted PO file containing arbitrary JavaScript payloads embedded within the extracted comments field. Once the crafted file is processed and imported by the Loco Translate plugin, the malicious payload is persistently stored within the database.\nThe attack flow proceeds as follows: 1. The attacker authenticates with translator privileges. 2. The attacker crafts a Portable Object (PO) file containing an XSS payload inside the extracted comments section. 3. The attacker uploads or saves the PO file via the Loco Translate interface. 4. The plugin parses the file and stores the malicious comment data without adequate sanitization. 5. Any user, including higher-privileged administrators, who navigates to the administrative page displaying the translated strings triggers the execution of the stored script.\nThe payload executes within the victim's browser session, allowing the attacker to inherit the victim's session context and privileges. Post-exploitation impact includes the potential execution of unauthorized administrative actions, creation of new malicious accounts, or modification of core application settings depending on the victim's permission level."
}