WordPress Loco Translate Plugin <= 2.6.9 is vulnerable to Cross Site Request Forgery (CSRF)<\/p>
Software: Loco Translate<\/p>
Link: https:\/\/wordpress.org\/plugins\/loco-translate\/#developers<\/p>
Affected Version <= 2.6.9<\/p>
Fixed in version 2.6.10 <\/p>","date":"2024-06-21"},{"id":"a6fa2a6fa1ddc4b301efdb2b991f972cbf76a297","name":"Loco Translate <= 2.6.9 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loco-translate\/loco-translate-269-cross-site-request-forgery","description":"The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.9. This is due to missing or incorrect nonce validation on the 'init' function. This makes it possible for unauthenticated attackers to save or delete a configuration via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2024-06-21"},{"id":"EUVD-2024-37053","name":"EUVD-2024-37053","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-37053","description":"Cross-Site Request Forgery (CSRF) vulnerability in Tim Whitlock Loco Translate allows Cross Site Request Forgery.This issue affects Loco Translate: from n\/a through 2.6.9.","date":"2025-01-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"28bd7778b9a17ae6fe96e831cb8d1d30dee29a2b88031d155e798fc082492c0a","name":"Loco Translate [loco-translate] < 2.8.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.8.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-4146","name":"Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-4146","description":"The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018update_href\u2019 parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"0000-00-00"},{"id":"4123c773fbcadd0678daa8c7f228fe8ddf16f250","name":"Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loco-translate\/loco-translate-282-reflected-cross-site-scripting-via-update-href-parameter","description":"The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018update_href\u2019 parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2026-03-30"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"7935fe217da60e2b66b0c9ca5dd6733e4bf9d9387b0994c1664a70c5b7132864","name":"Loco Translate [loco-translate] < 2.8.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.8.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-1921","name":"CVE-2026-1921","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-1921","description":"[en] The Loco Translate plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8.2 via the `fsReference` AJAX route. This is due to the `findSourceFile()` method normalizing user-supplied `ref` paths containing `..\/` directory traversal sequences without validating that the resolved path remains within the intended bundle or content directory. This makes it possible for authenticated attackers, with Translator-level access and above (custom `loco_admin` capability required, granted to the `translator` role and administrators by default), to read arbitrary `.php`, `.js`, `.json`, and `.twig` files from the server filesystem outside the intended translation directory. Files named wp-config.php are excluded.","date":"2026-05-05"},{"id":"47a9c55553e32104d7c723b9036033ef23f4bb01","name":"Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loco-translate\/loco-translate-282-authenticated-translator-path-traversal-to-limited-file-read-via-ref-parameter","description":"The Loco Translate plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8.2 via the `fsReference` AJAX route. This is due to the `findSourceFile()` method normalizing user-supplied `ref` paths containing `..\/` directory traversal sequences without validating that the resolved path remains within the intended bundle or content directory. This makes it possible for authenticated attackers, with Translator-level access and above (custom `loco_admin` capability required, granted to the `translator` role and administrators by default), to read arbitrary `.php`, `.js`, `.json`, and `.twig` files from the server filesystem outside the intended translation directory. Files named wp-config.php are excluded.","date":"2026-05-04"},{"id":"5b135bb8e7ddd44c7024e9c95d5081833807f340","name":"WordPress Loco Translate Plugin <= 2.8.2 is vulnerable to Directory Traversal","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/loco-translate\/vulnerability\/wordpress-loco-translate-plugin-2-8-2-authenticated-translator-path-traversal-to-limited-file-read-vulnerability","description":"
WordPress Loco Translate Plugin <= 2.8.2 is vulnerable to Directory Traversal<\/p>
Software: Loco Translate<\/p>
Fixed in version 2.8.3 <\/p>
Affected Version <= 2.8.2<\/p>
CVE: CVE-2026-1921<\/p>","date":"2026-05-04"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"h","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"4.9","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"4.9","severity":"medium","av":"network","ac":"low","pr":"high","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"0fd5ffebb0ea44c61a655f1b2965e3516399a493b81cc58d5aee73ce5dc95e9f","name":"Loco Translate [loco-translate] < 2.8.6","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.8.6","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-15005","name":"CVE-2026-15005","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-15005","description":"[en] The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php:\/\/filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2026-07-16"},{"id":"41c926e140c20353da03e9cd920c712c8a080892","name":"Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loco-translate\/loco-translate-285-cross-site-request-forgery-to-remote-code-execution-via-template-parameter","description":"The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php:\/\/filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2026-07-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}},{"uuid":"628df735da8e243b001c843c8d00edd2bd7cd2bc76ddbeaf26cef76ee6e83b50","name":"Loco Translate [loco-translate] < 2.8.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.8.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-15066","name":"CVE-2026-15066","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-15066","description":"[en] The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-08-16"},{"id":"1121277c1214e388a6504d7ba8cc38181e8ca9ac","name":"Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/loco-translate\/loco-translate-287-authenticated-translator-stored-cross-site-scripting-via-po-file-extracted-comments","description":"The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-08-15"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"6.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1786947986"}