Cross-Site Scripting (XSS) in Translate WordPress with Weglot Plugin
CVE-2026-88784

Currently unrated

Key Information:

Vendor

WordPress
Status
Translate WordPress With Weglot 2.0
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-88784?

The Translate WordPress with Weglot plugin version 2.0 and prior is susceptible to a Cross-Site Scripting (XSS) vulnerability due to the improper handling of URLs during the translation process. This flaw allows unauthorized users to inject malicious scripts into translated pages, which are then executed in the browsers of visitors viewing those pages. By failing to escape URLs and incorrectly reversing previous encoding, the plugin creates an opportunity for attackers to embed harmful payloads, jeopardizing user security and trust.

Affected Version(s)

Translate WordPress with Weglot 2.0 0 < 6.4.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-88784 - Proof of Concept

References

https://wpscan.com/vulnerability/0a567730-5dd9-4bcb-b955-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Herman
WPScan
.