All vulnerabilities
CVE-2026-88784

Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting

Unknown Translate WordPress with Weglot 2.0Applications & CMS
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.4.3Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 6.4.3Translate WordPress with Weglot 2.0CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.

Text from CVE List

Affected versions 1

  • Translate WordPress with Weglot 2.0affected: all versions before 6.4.3CVE List

References 1