CVE-2026-88784 — Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and rev…
Published: 2026-10-21 · CVSS: 7.5 · CVSS 3.1
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7