Advisories · Technology

Loco Translate.

Every CVE that names Loco Translate among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-94239 CVE record

CVSS 6.8 Medium

Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration
- Loco Translate
- Cross-site scripting (XSS)
Not analysed yet 3 Oct 2026
CVE-2026-94238 CVE record

CVSS 6.8 Medium

Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter
- Loco Translate
- Path traversal
Not analysed yet 3 Oct 2026
CVE-2022-0765 CVE record

Loco Translate < 2.6.1 - Authenticated Stored Cross-Site Scripting
- Loco Translate
- Cross-site scripting (XSS)
Not analysed yet 18 Apr 2022
CVE-2021-24721 CVE record

Loco Translate < 2.5.4 - Authenticated PHP Code Injection
- Loco Translate
- Code injection
Not analysed yet 8 Nov 2021