CVE-2022-0765: Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-18 · updated 2026-06-17
Weakness: CWE-79

Description

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.

Affected products

Loco Translate: before 2.6.1 — fixed in 2.6.1

How to fix

Upgrade to a fixed version: Loco Translate 2.6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0765 or the next vulnerability affects your stack