The vulnerability is a stored cross‑site scripting flaw in the Translate WordPress with Weglot plugin that occurs when the plugin rewrites URLs for translated pages. It fails to escape the URLs it re‑inserts and reverses any prior encoding, which lets unauthenticated users embed malicious scripts that persist in the page content. When a visitor views the page in a translated language, the stored script runs in their browser, potentially stealing session cookies, defacing content, or enabling further client‑side attacks.

WordPress installations that use the Translate WordPress with Weglot plugin, versions older than 6.4.3, are affected. The flaw exists in all releases prior to 6.4.3 and is susceptible whenever the plugin rewrites links in translated content.

With a CVSS score of 7.5 the vulnerability is considered medium to high severity. The EPSS score is less than 1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. Despite that, the flaw does not require authentication and can be triggered by simply providing a malicious payload that the plugin stores and later injects into the translated page, allowing an attacker to execute arbitrary scripts in the browsers of any user who accesses that translated route.