Skip to contentTimwhitlock Loco Translate vulnerabilities
- timwhitlock loco translateLoco Translate < 2.8.9 - Translator+ Stored XSS via Bundle ConfigurationCVE-2026-942396.8 Medium
- timwhitlock loco translateLoco Translate < 2.8.9 - Translator+ Limited File Read via 'path' ParameterCVE-2026-942386.8 Medium
- timwhitlock loco translateLoco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted CommentsCVE-2026-150666.4 Medium
- timwhitlock loco translateLoco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' ParameterCVE-2026-150058.8 High
- timwhitlock loco translateLoco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' ParameterCVE-2026-19214.9 Medium
- timwhitlock loco translateLoco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' ParameterCVE-2026-41466.1 Medium
- tim w loco translateWordPress Loco Translate plugin <= 2.6.9 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-372364.3 Medium
- loco translate project translate, timwhitlock loco translate +1 moreLoco Translate < 2.6.1 - Authenticated Stored Cross-Site ScriptingCVE-2022-07655.4 Medium
- loco translate project translate, timwhitlock loco translate +1 moreLoco Translate < 2.5.4 - Authenticated PHP Code InjectionCVE-2021-247216.5 Medium