CVE-2026-88784

HighCVSS 7.5/10Last modified Oct 21, 2026

Description

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
UnknownTranslate WordPress with Weglot 2.0< 6.4.3

References

Timeline

Published
Oct 21, 2026
Last modified
Oct 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-887854.7The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL querCVE-2026-887886.8The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a froCVE-2026-887898.6Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus frCVE-2026-88797.5Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContenCVE-2026-887904.8A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/elecCVE-2026-887913.4The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule toCVE-2026-887928.8The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionarCVE-2026-887938.8The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a CVE-2026-887948.2Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML fileCVE-2026-887959.0The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from datCVE-2026-887977.1The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it tCVE-2026-887985.3The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key