Skip to content
Noroxi

Loco Translate

loco-translate · plugin

Known security vulnerabilities for Loco Translate. Find out in seconds which version runs on your site with WP Lens.

5 known vulnerabilities

latest Aug 16, 2026

Vulnerabilities

  • CVE-2026-15005

    Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter

    High 8.8

  • CVE-2026-15066

    Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments

    Medium 6.4

  • CVE-2026-4146

    Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter

    Medium 6.1

  • CVE-2026-1921

    Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter

    Medium 4.9

  • CVE-2024-37236

    WordPress Loco Translate plugin <= 2.6.9 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 4.3

← Back to directory