Weblate is a web‑based localization platform that offers a live search preview of translation units. Prior to version 2026.5, the preview rendered the unit source and context fields as raw HTML without escaping. Contributors could therefore insert arbitrary HTML and CSS into these fields, and the content would execute in the authenticated editor of any user whose search matched the unit. The vulnerability is a stored HTML injection (CWE‑79) that enables cross‑site scripting within the Weblate interface, potentially allowing attackers to steal session cookies, inject malicious scripts, or perform other unauthorized actions in the context of authenticated editors.

WeblateOrg weblate deployments running versions prior to 2026.5 are affected. The fix is available in the release tagged weblate‑2026.5. Any instance that has not applied this update, including older releases such as 2026.4, 2026.3, and earlier, remains vulnerable.

The CVSS score of 4.6 indicates a medium severity level, and the vulnerability is not listed in CISA’s KEV catalog. The exploit probability is unknown because EPSS is not available. The attack vector is inferred to be local: the attacker must act through a contributor role or otherwise manipulate content in the unit source or context fields. Once an attacker successfully injects malicious HTML, it will persist and execute in the editor for every authenticated user performing a matching search, giving the attacker persistent cross‑site scripting capability within the Weblate instance.