Stored Cross-Site Scripting Vulnerability in PO/MO Editor Plugin for WordPress

CVE-2026-97020

What is CVE-2026-97020?

The PO/MO Editor plugin for WordPress presents a serious vulnerability through stored cross-site scripting due to inadequate input sanitization and output escaping. This flaw allows authenticated users, with a minimum of subscriber access, to embed arbitrary web scripts through the 'podata' parameter. Once injected, these scripts will execute when a user visits the infected page. The dangerous payload is delivered as a replacement translation file, allowing the attacker to override core strings and potentially manipulate the user experience in malicious ways.

References