Advisories · Technology

timwhitlock Loco Translate.

Every CVE that names timwhitlock Loco Translate among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-15066 CVE record

CVSS 6.4 Medium

Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments
- timwhitlock Loco Translate
- Cross-site scripting (XSS)
Not analysed yet 16 Aug 2026
CVE-2026-15005 CVE record

CVSS 8.8 High

Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
- timwhitlock Loco Translate
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2026
CVE-2026-1921 CVE record

CVSS 4.9 Medium

Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter
- timwhitlock Loco Translate
- Path traversal
Not analysed yet 5 May 2026
CVE-2026-4146 CVE record

CVSS 6.1 Medium

Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter
- timwhitlock Loco Translate
- Cross-site scripting (XSS)
Not analysed yet 31 Mar 2026