The Loco Translate WordPress plugin, versions before 2.8.9, contains a flaw where certain bundle configuration values are saved and then displayed on an admin page without proper sanitisation or escaping. This allows any user who has the translator capability or higher to inject malicious scripts that will be executed in the browsers of privileged users, such as administrators, when they view the affected admin interface.

All installations of the Loco Translate plugin for WordPress running any version earlier than 2.8.9 are vulnerable. WordPress sites that have the plugin deployed should verify the current version and apply the fix if required.

The vulnerability requires a user with translator-level or greater privileges to supply malicious configuration data. Based on the description, the attack vector is a stored cross‑site scripting path in the admin page. The EPSS score of < 1% indicates a very low likelihood of exploitation, while the CVSS score of 6.8 reflects medium severity. The vulnerability is not listed in CISA’s KEV catalog, so it is not currently known to be actively exploited.