CVE-2026-94239: Loco Translate WordPress Plugin XSS Flaw

CVE-2026-94239 Overview

CVE-2026-94239 is a Stored Cross-Site Scripting (XSS) vulnerability in the Loco Translate WordPress plugin before version 2.8.9. The plugin fails to sanitize and escape bundle configuration values before rendering them in an admin page. Users holding the translator capability or higher can inject JavaScript that executes in the browser of higher-privilege users, including administrators. The vulnerability is tracked under CWE-79 and affects a widely deployed translation plugin used across the WordPress ecosystem.

Critical Impact
Authenticated attackers with translator-level access can inject persistent scripts that hijack administrator sessions, create rogue admin accounts, or modify site content when administrators view the affected admin page.

Affected Products

Loco Translate WordPress plugin versions prior to 2.8.9
WordPress sites with the translator role or higher assigned to untrusted users
WordPress administrator sessions interacting with bundle configuration admin pages

Discovery Timeline

2026-10-03 - CVE-2026-94239 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-94239

Vulnerability Analysis

The Loco Translate plugin provides translation management for WordPress themes, plugins, and bundles. The vulnerability resides in how the plugin processes bundle configuration values submitted through its administrative interface. These values are persisted and later rendered back into an admin page without proper output encoding or input sanitization. Any script content stored in the vulnerable fields executes in the context of any administrator who visits the affected page. The attacker requires an authenticated account with the translator capability, which is a lower-privileged role commonly delegated to third-party contributors on multilingual sites.

Root Cause

The root cause is missing output escaping on bundle configuration values rendered in a Loco Translate admin page. The plugin trusts stored configuration data and emits it directly into HTML markup, allowing injected <script> tags or event-handler attributes to execute. This is a classic Stored XSS pattern cataloged under CWE-79, where improper neutralization of input during web page generation enables persistent script injection.

Attack Vector

An authenticated user with the translator role or higher submits malicious payloads through bundle configuration fields exposed by Loco Translate. The payload is stored in the WordPress database. When an administrator later browses the admin page that renders those bundle values, the injected JavaScript executes with the administrator's session context. The attacker can then issue privileged WordPress REST or admin-ajax requests, create new administrator accounts, modify plugin or theme files, or exfiltrate session cookies. User interaction from a privileged victim is required, which is reflected in the CVSS vector.

No public proof-of-concept code has been released. Technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-94239

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: payloads stored in Loco Translate bundle configuration records within the WordPress wp_options or plugin-specific tables.
Creation of new administrator accounts shortly after an administrator opened a Loco Translate admin page.
Outbound HTTP requests from administrator browsers to unfamiliar domains while interacting with the plugin UI.
Modified theme or plugin files timestamped after an administrator session that viewed Loco Translate bundle pages.

Detection Strategies

Audit stored Loco Translate configuration values for HTML, script tags, or encoded JavaScript patterns.
Review WordPress audit logs for POST requests to Loco Translate admin endpoints originating from translator-level accounts.
Inspect WordPress user tables for unauthorized role elevations or newly created accounts.
Correlate administrator browser telemetry with admin page visits to identify anomalous script execution.

Monitoring Recommendations

Enable a web application firewall rule set that logs script-like payloads submitted to wp-admin/admin.php?page=loco* endpoints.
Monitor WordPress role changes and administrator account creation events in near real time.
Alert on content-security-policy violation reports from administrator sessions.

How to Mitigate CVE-2026-94239

Immediate Actions Required

Upgrade the Loco Translate plugin to version 2.8.9 or later on every WordPress site in the environment.
Review all user accounts assigned the translator capability or higher and remove unneeded access.
Rotate administrator passwords and invalidate active sessions if the plugin was running a vulnerable version with untrusted translators.
Inspect stored bundle configuration data for injected payloads and purge any malicious entries.

Patch Information

The vendor addressed the issue in Loco Translate 2.8.9 by sanitizing and escaping bundle configuration values before output. Administrators should apply the update through the WordPress plugin management console or by deploying the fixed release via their configuration management pipeline. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Restrict the translator role to trusted users only until the patch is applied.
Deploy a web application firewall rule that blocks HTML and script characters in Loco Translate bundle configuration parameters.
Enforce a strict Content Security Policy on the WordPress admin interface to limit inline script execution.
Temporarily deactivate the Loco Translate plugin on sites where translator-level users cannot be fully trusted.

bash

# Configuration example - update Loco Translate via WP-CLI
wp plugin update loco-translate --version=2.8.9
wp plugin list --name=loco-translate --fields=name,status,version