CVE-2026-88784

Deferred Deferred - Pending Action

Cross-Site Scripting in Translate WordPress with Weglot Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-88784

EUVD

EUVD-2026-107088

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Translate WordPress with Weglot 2.0	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Weglot WordPress plugin before version 6.4.3. The plugin fails to properly escape URLs when rewriting links for translated pages, reversing any prior encoding. This allows unauthenticated users to inject malicious scripts that execute in the browsers of visitors viewing translated content.

Detection Guidance

Check the installed version of the Weglot plugin in your WordPress admin panel. If it is below 6.4.3, the system is vulnerable. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin files for version details.

Impact Analysis

An attacker could exploit this to store malicious scripts on your website. When visitors view translated pages, their browsers would execute the injected scripts, potentially stealing sensitive data like cookies or session tokens, or performing actions on their behalf without consent.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. It may result in unauthorized access to personal or health information, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the Weglot plugin to version 6.4.3 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-88784. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...