Live › vulnerability › CVE-2026-88784
Go to dashboardThe Translate WordPress with Weglot 2.0 plugin re-inserts URLs into translated pages without escaping them, and reverses earlier encoding on them. An unauthenticated attacker can store a script that runs in the browser of anyone who views the page in a translated language.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Translate WordPress with Weglot 2.0 plugin before 6.4.3 that serve pages in a translated language. Sites without this plugin or on 6.4.3 or later are not exposed. The sources do not say whether non-translated pages are affected.
No product ranges from the sources yet.
wp plugin get weglot --field=version6.4.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
This page as .md · .json · in your agent: get_signal("CVE-2026-88784")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.