CVE-2026-4146 in timwhitlock Loco Translate Plugin信息

摘要 (英语)

The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_href’ parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

负责

Wordfence

预定

2026-03-13

披露

2026-03-31

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
354313	timwhitlock Loco Translate Plugin Parameter 跨网站脚本	79	未定义	官方修复	CVE-2026-4146

描述

CPE

CWE

CVSS

漏洞利用

历史

差异

连接

威胁情报

API JSON

API XML

API CSV

◂ 上一步一览下一步 ▸

Do you need the next level of professionalism?

Upgrade your account now!