Security Alert Summary
The Loco Translate plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability via the update_href parameter in all versions up to and including 2.8.2. Insufficient input sanitization and output escaping allow an unauthenticated attacker to inject script that executes if a user is tricked into performing an action such as clicking a link.
CVE Details
- CVE ID: CVE-2026-4146
- Affected component: Loco Translate plugin for WordPress
- Affected versions: All versions up to and including 2.8.2
- Published: March 31, 2026 at 5:16:11 AM
- Last modified: March 31, 2026 at 5:16:11 AM
- CVSS v3.1: Base Score 6.1, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: No authentication required; privileges required: None; user interaction: Required
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation (Cross-site Scripting))
Technical Details
The vulnerability is a reflected cross-site scripting (XSS) issue caused by insufficient input sanitization and lack of proper output escaping for the update_href parameter. When a crafted value is supplied to this parameter and included in a page response without adequate encoding, an attacker can cause a victim’s browser to execute arbitrary JavaScript if the victim follows a specially crafted link or performs a required action.
Repository traces provided in the references point to files in the 2.8.2 tag (for example src/mvc/View.php and tpl/admin/config/version.php), where user-supplied input is incorporated into page output. The effect is reflected XSS: the payload is present in the immediate response and executes in the context of the victim’s browser session when the injected content is rendered.
Impact is limited to what reflected XSS typically enables: execution of scripts in the context of an affected page, which can be used to modify content presented to the user, steal tokens or cookies accessible to that page, or perform actions visible to the user’s session. The CVSS scoring indicates low confidentiality and integrity impacts and no availability impact, and exploitation requires user interaction.
How This Could Impact Your Website
Consider a typical small organization running Loco Translate where an administrator, an editor, and an external translator each access the WordPress admin area. If an attacker crafts a URL that abuses the update_href parameter and convinces one of these users to click it (for example via a phishing email), the injected script could run in that user’s browser. Possible practical consequences include exposure of limited account information visible to the user, unauthorized actions performed in the context of their session, or capture of data accessible to the page.
Even with limited technical impact as scored (confidentiality and integrity rated low), this can increase the risk of targeted phishing or social engineering against staff and contractors who have higher-value access. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other non-admin accounts with access to areas where translations or plugin settings are managed.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and logs for unusual behavior, especially unexpected admin-area requests and suspicious referrer strings or query parameters.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.2/src/mvc/View.php#L259
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.2/tpl/admin/config/version.php#L17
- https://plugins.trac.wordpress.org/changeset/3482475/loco-translate
- https://www.wordfence.com/threat-intel/vulnerabilities/id/faa6c744-7586-47ee-b2ce-af972ee8b4f7?source=cve
