CVE-2026-4146 in timwhitlock Loco Translate Plugininformación

Resumen (Inglés)

The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_href’ parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Responsable

Wordfence

Reservar

2026-03-13

Divulgación

2026-03-31

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354313	timwhitlock Loco Translate Plugin Parameter secuencias de comandos en sitios cruzados	79	No está definido	Arreglo oficial	CVE-2026-4146

Descripción

CPE

CWE

CVSS

Hazañas

Historia

Diferencia

Relacionar

Inteligencia de amenazas

API JSON

API XML

API CSV

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you need the next level of professionalism?

Upgrade your account now!