CVE

CVE-2022-0765

5.4

CVSS

Description

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.

Attack Vector

Privileges Req.

User Interaction

loco translate

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

WordPress Loco Translate < 2.6.1 - Cross-Site Scripting

Loco Translate WordPress plugin before 2.6.1 contains a stored cross-site scripting vulnerability caused by improper removal of inline events from source translation strings, allowing authenticated users to inject arbitrary JavaScript payloads. References: https://wpscan.com/vulnerability/58838f51-323d-41e0-8c85-8e113dc2c587 https://patchstack.com/database/vulnerability/loco-translate/wordpress-loco-translate-plugin-2-6-0-authenticated-stored-cross-site-scripting-xss-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2022-0765 Remediation: Update to version 2.6.1 or later.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: loco translate

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →