The vulnerability occurs in the Loco Translate WordPress plugin, where the update_href parameter is not properly sanitized or escaped. This allows an attacker to embed malicious JavaScript into that parameter, causing the script to run automatically in the victim’s browser when the link is clicked. The attack can be performed by a unauthenticated attacker, and the resulting client‑side code execution can lead to cookie theft, session hijacking, defacement, or execution of arbitrary browser‑based actions.

Affected systems include the timwhitlock Loco Translate plugin for WordPress, versions 2.8.2 and earlier. Administrators should verify that they are running a version later than 2.8.2, as newer releases address the issue. The impact is limited to web pages that render the update_href approach; it does not provide a direct server‑side compromise.

The CVSS score of 6.1 classifies this as a moderate severity flaw. No EPSS score is published, and the vulnerability is not listed in KEV. The exploitation path is straightforward: an attacker crafts a link containing a malicious value for update_href and lures a user to click it. Because this requires only social engineering and does not rely on additional system weaknesses, the risk to sites that expose the parameter is non‑trivial. Administrators should treat this as a vulnerability that warrants prompt mitigation.