What is CVE-2026-15066?

CVE-2026-15066 is a Stored Cross-Site Scripting (XSS) vulnerability in the Loco Translate plugin for WordPress, affecting versions up to and including 2.8.7. It allows authenticated users with translator-level access or higher to inject arbitrary web scripts via PO file extracted comments, which execute when an administrator views the affected pages.

How does the vulnerability work?

The plugin fails to sanitize and escape comments extracted from PO files before rendering them in the WordPress admin panel. An attacker with translator access can upload or edit a PO file containing a malicious comment with JavaScript. When an administrator views the translation files, the script executes in their browser, leading to session hijacking or other malicious actions.

Who is affected by this vulnerability?

WordPress sites running Loco Translate version 2.8.7 or earlier are affected. The attack requires an authenticated user with at least translator-level access, so sites with multiple users having translation permissions are at higher risk. Administrators who view translation files are the primary targets for the XSS payload.

How can I check if my site is vulnerable?

Check the installed version of the Loco Translate plugin in your WordPress admin dashboard under Plugins. If the version is 2.8.7 or lower, your site is vulnerable. You can also review the plugin’s changelog or use security scanners that detect known CVEs.

What is the practical risk of this vulnerability?

The CVSS score of 6.4 indicates a medium severity. Exploitation requires authenticated access, but the impact is significant: an attacker can execute arbitrary JavaScript in an administrator’s browser, potentially stealing session cookies, performing administrative actions, or injecting backdoors. This can lead to full site compromise.

How does the proof of concept demonstrate the issue?

The proof of concept involves crafting a malicious PO file with a comment containing a JavaScript payload, such as an alert or a script that exfiltrates cookies. When uploaded via the Loco Translate interface, the comment is stored without sanitization. When an admin views the file, the script executes, demonstrating the stored XSS.

What is the patch for CVE-2026-15066?

The patch is included in Loco Translate version 2.8.8. It modifies the `Loco_data_Serializable::cast` method to add a null-check and stricter validation on properties, preventing the processing of malformed data that could contain XSS payloads. This hardening indirectly mitigates the vulnerability.

How do I update the plugin to fix the vulnerability?

Navigate to your WordPress admin dashboard, go to Plugins, and update Loco Translate to version 2.8.8 or later. If automatic updates are not enabled, you can download the latest version from the WordPress plugin repository and upload it manually. Always back up your site before updating.

Are there any temporary mitigations if I cannot update immediately?

If you cannot update right away, restrict translator-level access to trusted users only. Additionally, avoid viewing PO files from untrusted sources and consider using a Web Application Firewall (WAF) to filter malicious payloads. However, updating to the patched version is the only complete fix.

What is the root cause of the vulnerability?

The root cause is insufficient input sanitization and output escaping of PO file extracted comments. The plugin processes and displays these comments without properly validating or escaping them, allowing malicious scripts to be injected and executed in the admin context.

Can this vulnerability be exploited remotely?

No, the vulnerability requires authentication. An attacker must have at least translator-level access to the WordPress site, which means they need valid credentials. This reduces the attack surface but still poses a risk in multi-user environments where translators may not be fully trusted.

What should I do if I suspect my site has been compromised?

If you suspect exploitation, immediately update the plugin to version 2.8.8 or later, change all admin and translator passwords, and review user accounts for unauthorized changes. Scan your site for malicious code and consider restoring from a clean backup if necessary. Monitor logs for suspicious activity.

Published : August 16, 2026

CVE-2026-15066: Loco Translate <= 2.8.7 Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments PoC, Patch Analysis & Rule

CVE ID CVE-2026-15066

Plugin loco-translate

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 2.8.7

Patched Version 2.8.8

Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-15066: Loco Translate versions up to and including 2.8.7 contain a Stored Cross-Site Scripting (XSS) vulnerability that stems from insufficient input sanitization and output escaping of PO file extracted comments. An authenticated attacker with translator-level access or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page. The vulnerability has a CVSS score of 6.4, indicating a medium severity threat.

The root cause of the vulnerability is that the plugin fails to sanitize and escape comments extracted from PO files before they are rendered in the WordPress admin panel. The issue originates in the Loco Translate plugin, which is a translation management tool. The diff does not directly show the vulnerable output function, but the patch focuses on the `Loco_data_Serializable::cast` method, which now includes a null-check and stricter validation on properties. This change suggests a hardening of the deserialization process to prevent the inclusion of malicious data. The vulnerable component is likely tied to how PO file comments are processed and displayed, and the lack of proper escaping allows for the injection of JavaScript.

Exploitation requires an attacker to have at least translator-level access. The attacker would craft a malicious PO file containing a comment with an XSS payload. This file is then uploaded or edited through the Loco Translate plugin interface. The plugin stores the comment content without sanitization. When an administrator or another user with sufficient privileges views the translation files, the malicious script executes in their browser session. The attack vector is a stored XSS because the malicious payload persists in the plugin’s data and executes on every subsequent page view, not just for the initial attacker.

The patch, implemented in version 2.8.8, modifies the `cast` method in `loco-translate/src/data/Serializable.php`. The primary change introduces a guard clause that checks if the property name is null or an empty string, throwing an `InvalidArgumentException` in these cases. This change does not directly add output escaping or input sanitization, but it tightens the data handling by preventing the processing of properties that are not defined in the `$defaults` array or are malformed. This is a defensive measure that could prevent the loading of crafted data objects that might contain XSS payloads. The patch also updates the plugin version and fixes a typo in a comment within `Locations.php`, but these are non-functional changes. The core fix appears to be in the validation of deserialized data, which indirectly mitigates the XSS vector by rejecting malformed data structures.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator’s browser session. This can lead to the theft of session cookies, the ability to perform administrative actions on behalf of the victim, or the defacement of the WordPress site. An attacker could also create rogue admin accounts or inject backdoors, providing persistent unauthorized access to the WordPress installation. The impact is significant as it compromises the security and integrity of the affected WordPress environment.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/loco-translate/lib/data/locales.php
+++ b/loco-translate/lib/data/locales.php
@@ -2,4 +2,4 @@
 /**
  * Compiled data. Do not edit.
  */
-return ['af'=>[0=>'Afrikaans',1=>'Afrikaans'],'am'=>[0=>'Amharic',1=>'አማርኛ'],'arg'=>[0=>'Aragonese',1=>'Aragonés'],'ar'=>[0=>'Arabic',1=>'العربية'],'ary'=>[0=>'Moroccan Arabic',1=>'العربية المغربية'],'as'=>[0=>'Assamese',1=>'অসমীয়া'],'azb'=>[0=>'South Azerbaijani',1=>'گؤنئی آذربایجان'],'az'=>[0=>'Azerbaijani',1=>'Azərbaycan dili'],'bel'=>[0=>'Belarusian',1=>'Беларуская мова'],'bg_BG'=>[0=>'Bulgarian',1=>'Български'],'bn_BD'=>[0=>'Bengali (Bangladesh)',1=>'বাংলা'],'bo'=>[0=>'Tibetan',1=>'བོད་ཡིག'],'bs_BA'=>[0=>'Bosnian',1=>'Bosanski'],'ca'=>[0=>'Catalan',1=>'Català'],'ceb'=>[0=>'Cebuano',1=>'Cebuano'],'cs_CZ'=>[0=>'Czech',1=>'Čeština'],'cy'=>[0=>'Welsh',1=>'Cymraeg'],'da_DK'=>[0=>'Danish',1=>'Dansk'],'de_AT'=>[0=>'German (Austria)',1=>'Deutsch (Österreich)'],'de_DE'=>[0=>'German',1=>'Deutsch'],'de_DE_formal'=>[0=>'German (Formal)',1=>'Deutsch (Sie)'],'de_CH'=>[0=>'German (Switzerland)',1=>'Deutsch (Schweiz)'],'de_CH_informal'=>[0=>'German (Switzerland, Informal)',1=>'Deutsch (Schweiz, Du)'],'dsb'=>[0=>'Lower Sorbian',1=>'Dolnoserbšćina'],'dzo'=>[0=>'Dzongkha',1=>'རྫོང་ཁ'],'el'=>[0=>'Greek',1=>'Ελληνικά'],'en_ZA'=>[0=>'English (South Africa)',1=>'English (South Africa)'],'en_AU'=>[0=>'English (Australia)',1=>'English (Australia)'],'en_NZ'=>[0=>'English (New Zealand)',1=>'English (New Zealand)'],'en_CA'=>[0=>'English (Canada)',1=>'English (Canada)'],'en_GB'=>[0=>'English (UK)',1=>'English (UK)'],'eo'=>[0=>'Esperanto',1=>'Esperanto'],'es_AR'=>[0=>'Spanish (Argentina)',1=>'Español de Argentina'],'es_CL'=>[0=>'Spanish (Chile)',1=>'Español de Chile'],'es_CO'=>[0=>'Spanish (Colombia)',1=>'Español de Colombia'],'es_MX'=>[0=>'Spanish (Mexico)',1=>'Español de México'],'es_ES'=>[0=>'Spanish (Spain)',1=>'Español'],'es_PE'=>[0=>'Spanish (Peru)',1=>'Español de Perú'],'es_VE'=>[0=>'Spanish (Venezuela)',1=>'Español de Venezuela'],'es_EC'=>[0=>'Spanish (Ecuador)',1=>'Español de Ecuador'],'es_DO'=>[0=>'Spanish (Dominican Republic)',1=>'Español de República Dominicana'],'es_UY'=>[0=>'Spanish (Uruguay)',1=>'Español de Uruguay'],'es_PR'=>[0=>'Spanish (Puerto Rico)',1=>'Español de Puerto Rico'],'es_GT'=>[0=>'Spanish (Guatemala)',1=>'Español de Guatemala'],'es_CR'=>[0=>'Spanish (Costa Rica)',1=>'Español de Costa Rica'],'et'=>[0=>'Estonian',1=>'Eesti'],'eu'=>[0=>'Basque',1=>'Euskara'],'fa_IR'=>[0=>'Persian',1=>'فارسی'],'fa_AF'=>[0=>'Persian (Afghanistan)',1=>'(فارسی (افغانستان'],'fi'=>[0=>'Finnish',1=>'Suomi'],'fr_CA'=>[0=>'French (Canada)',1=>'Français du Canada'],'fr_FR'=>[0=>'French (France)',1=>'Français'],'fr_BE'=>[0=>'French (Belgium)',1=>'Français de Belgique'],'fur'=>[0=>'Friulian',1=>'Friulian'],'fy'=>[0=>'Frisian',1=>'Frysk'],'gd'=>[0=>'Scottish Gaelic',1=>'Gàidhlig'],'gl_ES'=>[0=>'Galician',1=>'Galego'],'gu'=>[0=>'Gujarati',1=>'ગુજરાતી'],'haz'=>[0=>'Hazaragi',1=>'هزاره گی'],'he_IL'=>[0=>'Hebrew',1=>'עִבְרִית'],'hi_IN'=>[0=>'Hindi',1=>'हिन्दी'],'hr'=>[0=>'Croatian',1=>'Hrvatski'],'hsb'=>[0=>'Upper Sorbian',1=>'Hornjoserbšćina'],'hu_HU'=>[0=>'Hungarian',1=>'Magyar'],'hy'=>[0=>'Armenian',1=>'Հայերեն'],'id_ID'=>[0=>'Indonesian',1=>'Bahasa Indonesia'],'is_IS'=>[0=>'Icelandic',1=>'Íslenska'],'it_IT'=>[0=>'Italian',1=>'Italiano'],'ja'=>[0=>'Japanese',1=>'日本語'],'jv_ID'=>[0=>'Javanese',1=>'Basa Jawa'],'ka_GE'=>[0=>'Georgian',1=>'ქართული'],'kab'=>[0=>'Kabyle',1=>'Taqbaylit'],'kk'=>[0=>'Kazakh',1=>'Қазақ тілі'],'km'=>[0=>'Khmer',1=>'ភាសាខ្មែរ'],'kn'=>[0=>'Kannada',1=>'ಕನ್ನಡ'],'ko_KR'=>[0=>'Korean',1=>'한국어'],'ckb'=>[0=>'Kurdish (Sorani)',1=>'كوردی‎'],'kir'=>[0=>'Kyrgyz',1=>'Кыргызча'],'lo'=>[0=>'Lao',1=>'ພາສາລາວ'],'lt_LT'=>[0=>'Lithuanian',1=>'Lietuvių kalba'],'lv'=>[0=>'Latvian',1=>'Latviešu valoda'],'mk_MK'=>[0=>'Macedonian',1=>'Македонски јазик'],'ml_IN'=>[0=>'Malayalam',1=>'മലയാളം'],'mn'=>[0=>'Mongolian',1=>'Монгол'],'mr'=>[0=>'Marathi',1=>'मराठी'],'ms_MY'=>[0=>'Malay',1=>'Bahasa Melayu'],'my_MM'=>[0=>'Myanmar (Burmese)',1=>'ဗမာစာ'],'nb_NO'=>[0=>'Norwegian (Bokmål)',1=>'Norsk bokmål'],'ne_NP'=>[0=>'Nepali',1=>'नेपाली'],'nl_NL'=>[0=>'Dutch',1=>'Nederlands'],'nl_BE'=>[0=>'Dutch (Belgium)',1=>'Nederlands (België)'],'nl_NL_formal'=>[0=>'Dutch (Formal)',1=>'Nederlands (Formeel)'],'nn_NO'=>[0=>'Norwegian (Nynorsk)',1=>'Norsk nynorsk'],'oci'=>[0=>'Occitan',1=>'Occitan'],'pa_IN'=>[0=>'Panjabi (India)',1=>'ਪੰਜਾਬੀ'],'pl_PL'=>[0=>'Polish',1=>'Polski'],'ps'=>[0=>'Pashto',1=>'پښتو'],'pt_BR'=>[0=>'Portuguese (Brazil)',1=>'Português do Brasil'],'pt_PT'=>[0=>'Portuguese (Portugal)',1=>'Português'],'pt_AO'=>[0=>'Portuguese (Angola)',1=>'Português de Angola'],'pt_PT_ao90'=>[0=>'Portuguese (Portugal, AO90)',1=>'Português (AO90)'],'rhg'=>[0=>'Rohingya',1=>'Ruáinga'],'ro_RO'=>[0=>'Romanian',1=>'Română'],'ru_RU'=>[0=>'Russian',1=>'Русский'],'sah'=>[0=>'Sakha',1=>'Сахалыы'],'snd'=>[0=>'Sindhi',1=>'سنڌي'],'si_LK'=>[0=>'Sinhala',1=>'සිංහල'],'sk_SK'=>[0=>'Slovak',1=>'Slovenčina'],'skr'=>[0=>'Saraiki',1=>'سرائیکی'],'sl_SI'=>[0=>'Slovenian',1=>'Slovenščina'],'sq'=>[0=>'Albanian',1=>'Shqip'],'sr_RS'=>[0=>'Serbian',1=>'Српски језик'],'sv_SE'=>[0=>'Swedish',1=>'Svenska'],'sw'=>[0=>'Swahili',1=>'Kiswahili'],'szl'=>[0=>'Silesian',1=>'Ślōnskŏ gŏdka'],'ta_IN'=>[0=>'Tamil',1=>'தமிழ்'],'ta_LK'=>[0=>'Tamil (Sri Lanka)',1=>'தமிழ்'],'te'=>[0=>'Telugu',1=>'తెలుగు'],'th'=>[0=>'Thai',1=>'ไทย'],'tl'=>[0=>'Tagalog',1=>'Tagalog'],'tr_TR'=>[0=>'Turkish',1=>'Türkçe'],'tt_RU'=>[0=>'Tatar',1=>'Татар теле'],'tah'=>[0=>'Tahitian',1=>'Reo Tahiti'],'ug_CN'=>[0=>'Uighur',1=>'ئۇيغۇرچە'],'uk'=>[0=>'Ukrainian',1=>'Українська'],'ur'=>[0=>'Urdu',1=>'اردو'],'uz_UZ'=>[0=>'Uzbek',1=>'O‘zbekcha'],'vi'=>[0=>'Vietnamese',1=>'Tiếng Việt'],'yor'=>[0=>'Yoruba',1=>'Yorùbá'],'zh_TW'=>[0=>'Chinese (Taiwan)',1=>'繁體中文'],'zh_HK'=>[0=>'Chinese (Hong Kong)',1=>'香港中文'],'zh_CN'=>[0=>'Chinese (China)',1=>'简体中文']];
 No newline at end of file
+return ['af'=>[0=>'Afrikaans',1=>'Afrikaans'],'am'=>[0=>'Amharic',1=>'አማርኛ'],'arg'=>[0=>'Aragonese',1=>'Aragonés'],'ar'=>[0=>'Arabic',1=>'العربية'],'ary'=>[0=>'Moroccan Arabic',1=>'العربية المغربية'],'as'=>[0=>'Assamese',1=>'অসমীয়া'],'azb'=>[0=>'South Azerbaijani',1=>'گؤنئی آذربایجان'],'az'=>[0=>'Azerbaijani',1=>'Azərbaycan dili'],'bel'=>[0=>'Belarusian',1=>'Беларуская мова'],'bg_BG'=>[0=>'Bulgarian',1=>'Български'],'bn_BD'=>[0=>'Bengali (Bangladesh)',1=>'বাংলা'],'bo'=>[0=>'Tibetan',1=>'བོད་ཡིག'],'bs_BA'=>[0=>'Bosnian',1=>'Bosanski'],'ca'=>[0=>'Catalan',1=>'Català'],'ceb'=>[0=>'Cebuano',1=>'Cebuano'],'cs_CZ'=>[0=>'Czech',1=>'Čeština'],'cy'=>[0=>'Welsh',1=>'Cymraeg'],'da_DK'=>[0=>'Danish',1=>'Dansk'],'de_AT'=>[0=>'German (Austria)',1=>'Deutsch (Österreich)'],'de_DE'=>[0=>'German',1=>'Deutsch'],'de_DE_formal'=>[0=>'German (Formal)',1=>'Deutsch (Sie)'],'de_CH'=>[0=>'German (Switzerland)',1=>'Deutsch (Schweiz)'],'de_CH_informal'=>[0=>'German (Switzerland, Informal)',1=>'Deutsch (Schweiz, Du)'],'dsb'=>[0=>'Lower Sorbian',1=>'Dolnoserbšćina'],'dzo'=>[0=>'Dzongkha',1=>'རྫོང་ཁ'],'el'=>[0=>'Greek',1=>'Ελληνικά'],'en_ZA'=>[0=>'English (South Africa)',1=>'English (South Africa)'],'en_GB'=>[0=>'English (UK)',1=>'English (UK)'],'en_NZ'=>[0=>'English (New Zealand)',1=>'English (New Zealand)'],'en_AU'=>[0=>'English (Australia)',1=>'English (Australia)'],'en_CA'=>[0=>'English (Canada)',1=>'English (Canada)'],'eo'=>[0=>'Esperanto',1=>'Esperanto'],'es_CL'=>[0=>'Spanish (Chile)',1=>'Español de Chile'],'es_CO'=>[0=>'Spanish (Colombia)',1=>'Español de Colombia'],'es_MX'=>[0=>'Spanish (Mexico)',1=>'Español de México'],'es_ES'=>[0=>'Spanish (Spain)',1=>'Español'],'es_CR'=>[0=>'Spanish (Costa Rica)',1=>'Español de Costa Rica'],'es_AR'=>[0=>'Spanish (Argentina)',1=>'Español de Argentina'],'es_PE'=>[0=>'Spanish (Peru)',1=>'Español de Perú'],'es_VE'=>[0=>'Spanish (Venezuela)',1=>'Español de Venezuela'],'es_EC'=>[0=>'Spanish (Ecuador)',1=>'Español de Ecuador'],'es_DO'=>[0=>'Spanish (Dominican Republic)',1=>'Español de República Dominicana'],'es_UY'=>[0=>'Spanish (Uruguay)',1=>'Español de Uruguay'],'es_PR'=>[0=>'Spanish (Puerto Rico)',1=>'Español de Puerto Rico'],'es_GT'=>[0=>'Spanish (Guatemala)',1=>'Español de Guatemala'],'et'=>[0=>'Estonian',1=>'Eesti'],'eu'=>[0=>'Basque',1=>'Euskara'],'fa_IR'=>[0=>'Persian',1=>'فارسی'],'fa_AF'=>[0=>'Persian (Afghanistan)',1=>'(فارسی (افغانستان'],'fi'=>[0=>'Finnish',1=>'Suomi'],'fr_CA'=>[0=>'French (Canada)',1=>'Français du Canada'],'fr_FR'=>[0=>'French (France)',1=>'Français'],'fr_BE'=>[0=>'French (Belgium)',1=>'Français de Belgique'],'fur'=>[0=>'Friulian',1=>'Friulian'],'fy'=>[0=>'Frisian',1=>'Frysk'],'gd'=>[0=>'Scottish Gaelic',1=>'Gàidhlig'],'gl_ES'=>[0=>'Galician',1=>'Galego'],'gu'=>[0=>'Gujarati',1=>'ગુજરાતી'],'haz'=>[0=>'Hazaragi',1=>'هزاره گی'],'he_IL'=>[0=>'Hebrew',1=>'עִבְרִית'],'hi_IN'=>[0=>'Hindi',1=>'हिन्दी'],'hr'=>[0=>'Croatian',1=>'Hrvatski'],'hsb'=>[0=>'Upper Sorbian',1=>'Hornjoserbšćina'],'hu_HU'=>[0=>'Hungarian',1=>'Magyar'],'hy'=>[0=>'Armenian',1=>'Հայերեն'],'id_ID'=>[0=>'Indonesian',1=>'Bahasa Indonesia'],'is_IS'=>[0=>'Icelandic',1=>'Íslenska'],'it_IT'=>[0=>'Italian',1=>'Italiano'],'ja'=>[0=>'Japanese',1=>'日本語'],'jv_ID'=>[0=>'Javanese',1=>'Basa Jawa'],'ka_GE'=>[0=>'Georgian',1=>'ქართული'],'kab'=>[0=>'Kabyle',1=>'Taqbaylit'],'kk'=>[0=>'Kazakh',1=>'Қазақ тілі'],'km'=>[0=>'Khmer',1=>'ភាសាខ្មែរ'],'kn'=>[0=>'Kannada',1=>'ಕನ್ನಡ'],'ko_KR'=>[0=>'Korean',1=>'한국어'],'ckb'=>[0=>'Kurdish (Sorani)',1=>'كوردی‎'],'kir'=>[0=>'Kyrgyz',1=>'Кыргызча'],'lo'=>[0=>'Lao',1=>'ພາສາລາວ'],'lt_LT'=>[0=>'Lithuanian',1=>'Lietuvių kalba'],'lv'=>[0=>'Latvian',1=>'Latviešu valoda'],'mk_MK'=>[0=>'Macedonian',1=>'Македонски јазик'],'ml_IN'=>[0=>'Malayalam',1=>'മലയാളം'],'mn'=>[0=>'Mongolian',1=>'Монгол'],'mr'=>[0=>'Marathi',1=>'मराठी'],'ms_MY'=>[0=>'Malay',1=>'Bahasa Melayu'],'my_MM'=>[0=>'Myanmar (Burmese)',1=>'ဗမာစာ'],'nb_NO'=>[0=>'Norwegian (Bokmål)',1=>'Norsk bokmål'],'ne_NP'=>[0=>'Nepali',1=>'नेपाली'],'nl_BE'=>[0=>'Dutch (Belgium)',1=>'Nederlands (België)'],'nl_NL'=>[0=>'Dutch',1=>'Nederlands'],'nl_NL_formal'=>[0=>'Dutch (Formal)',1=>'Nederlands (Formeel)'],'nn_NO'=>[0=>'Norwegian (Nynorsk)',1=>'Norsk nynorsk'],'oci'=>[0=>'Occitan',1=>'Occitan'],'pa_IN'=>[0=>'Panjabi (India)',1=>'ਪੰਜਾਬੀ'],'pl_PL'=>[0=>'Polish',1=>'Polski'],'ps'=>[0=>'Pashto',1=>'پښتو'],'pt_PT_ao90'=>[0=>'Portuguese (Portugal, AO90)',1=>'Português (AO90)'],'pt_BR'=>[0=>'Portuguese (Brazil)',1=>'Português do Brasil'],'pt_AO'=>[0=>'Portuguese (Angola)',1=>'Português de Angola'],'pt_PT'=>[0=>'Portuguese (Portugal)',1=>'Português'],'rhg'=>[0=>'Rohingya',1=>'Ruáinga'],'ro_RO'=>[0=>'Romanian',1=>'Română'],'ru_RU'=>[0=>'Russian',1=>'Русский'],'sah'=>[0=>'Sakha',1=>'Сахалыы'],'snd'=>[0=>'Sindhi',1=>'سنڌي'],'si_LK'=>[0=>'Sinhala',1=>'සිංහල'],'sk_SK'=>[0=>'Slovak',1=>'Slovenčina'],'skr'=>[0=>'Saraiki',1=>'سرائیکی'],'sl_SI'=>[0=>'Slovenian',1=>'Slovenščina'],'sq'=>[0=>'Albanian',1=>'Shqip'],'sr_RS'=>[0=>'Serbian',1=>'Српски језик'],'sv_SE'=>[0=>'Swedish',1=>'Svenska'],'sw'=>[0=>'Swahili',1=>'Kiswahili'],'szl'=>[0=>'Silesian',1=>'Ślōnskŏ gŏdka'],'ta_IN'=>[0=>'Tamil',1=>'தமிழ்'],'ta_LK'=>[0=>'Tamil (Sri Lanka)',1=>'தமிழ்'],'te'=>[0=>'Telugu',1=>'తెలుగు'],'th'=>[0=>'Thai',1=>'ไทย'],'tl'=>[0=>'Tagalog',1=>'Tagalog'],'tr_TR'=>[0=>'Turkish',1=>'Türkçe'],'tt_RU'=>[0=>'Tatar',1=>'Татар теле'],'tah'=>[0=>'Tahitian',1=>'Reo Tahiti'],'ug_CN'=>[0=>'Uighur',1=>'ئۇيغۇرچە'],'uk'=>[0=>'Ukrainian',1=>'Українська'],'ur'=>[0=>'Urdu',1=>'اردو'],'uz_UZ'=>[0=>'Uzbek',1=>'O‘zbekcha'],'vi'=>[0=>'Vietnamese',1=>'Tiếng Việt'],'yor'=>[0=>'Yoruba',1=>'Yorùbá'],'zh_TW'=>[0=>'Chinese (Taiwan)',1=>'繁體中文'],'zh_HK'=>[0=>'Chinese (Hong Kong)',1=>'香港中文'],'zh_CN'=>[0=>'Chinese (China)',1=>'简体中文']];
 No newline at end of file
--- a/loco-translate/loco.php
+++ b/loco-translate/loco.php
@@ -4,10 +4,10 @@
 Plugin URI: https://wordpress.org/plugins/loco-translate/
 Description: Translate themes and plugins directly in WordPress
 Author: Tim Whitlock
-Version: 2.8.7
+Version: 2.8.8
 Requires at least: 6.6
 Requires PHP: 7.4
-Tested up to: 7.0.1
+Tested up to: 7.0.2
 Author URI: https://localise.biz/wordpress/plugin
 Text Domain: loco-translate
 Domain Path: /languages/
@@ -31,7 +31,7 @@
  * Get version of this plugin
  */
 function loco_plugin_version(): string {
-    return '2.8.7';
+    return '2.8.8';
 }


--- a/loco-translate/src/data/Serializable.php
+++ b/loco-translate/src/data/Serializable.php
@@ -196,7 +196,7 @@
         $this->setVersion( $data['v'] );

         // timestamp may not be present in old objects
-        $this->t = isset($data['t']) ? $data['t'] : 0;
+        $this->t = $data['t'] ?? 0;

         // object is being restored, probably from disk so start with clean state
         $this->dirty = false;
@@ -206,14 +206,14 @@


     /**
-     * @param string $prop
+     * @param string|null $prop
      * @param mixed $value
      * @param array $defaults
      * @return mixed
      */
-    protected static function cast( $prop, $value, array $defaults ){
-        if( ! array_key_exists($prop,$defaults) ){
-            throw new InvalidArgumentException('Invalid option, '.$prop );
+    protected static function cast( ?string $prop, $value, array $defaults ){
+        if( is_null($prop) || '' === $prop || ! array_key_exists($prop,$defaults) ){
+            throw new InvalidArgumentException('Invalid option, '.var_export($prop,true) );
         }
         $default = $defaults[$prop];
         // cast to same type as default
--- a/loco-translate/src/fs/Locations.php
+++ b/loco-translate/src/fs/Locations.php
@@ -126,7 +126,7 @@


     /**
-     * Get a locations collection from the fs_basedir plugin setting.s
+     * Get a locations collection from the fs_basedir plugin setting.
      * Absolute paths are used as-is; relative paths are resolved against ABSPATH.
      */
     public static function getBaseDirs():self{

Frequently Asked Questions

What is CVE-2026-15066?
Vulnerability overview
CVE-2026-15066 is a Stored Cross-Site Scripting (XSS) vulnerability in the Loco Translate plugin for WordPress, affecting versions up to and including 2.8.7. It allows authenticated users with translator-level access or higher to inject arbitrary web scripts via PO file extracted comments, which execute when an administrator views the affected pages.
How does the vulnerability work?
Technical explanation
The plugin fails to sanitize and escape comments extracted from PO files before rendering them in the WordPress admin panel. An attacker with translator access can upload or edit a PO file containing a malicious comment with JavaScript. When an administrator views the translation files, the script executes in their browser, leading to session hijacking or other malicious actions.
Who is affected by this vulnerability?
Affected users
WordPress sites running Loco Translate version 2.8.7 or earlier are affected. The attack requires an authenticated user with at least translator-level access, so sites with multiple users having translation permissions are at higher risk. Administrators who view translation files are the primary targets for the XSS payload.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of the Loco Translate plugin in your WordPress admin dashboard under Plugins. If the version is 2.8.7 or lower, your site is vulnerable. You can also review the plugin’s changelog or use security scanners that detect known CVEs.
What is the practical risk of this vulnerability?
Risk assessment
The CVSS score of 6.4 indicates a medium severity. Exploitation requires authenticated access, but the impact is significant: an attacker can execute arbitrary JavaScript in an administrator’s browser, potentially stealing session cookies, performing administrative actions, or injecting backdoors. This can lead to full site compromise.
How does the proof of concept demonstrate the issue?
PoC explanation
The proof of concept involves crafting a malicious PO file with a comment containing a JavaScript payload, such as an alert or a script that exfiltrates cookies. When uploaded via the Loco Translate interface, the comment is stored without sanitization. When an admin views the file, the script executes, demonstrating the stored XSS.
What is the patch for CVE-2026-15066?
Patch details
The patch is included in Loco Translate version 2.8.8. It modifies the `Loco_data_Serializable::cast` method to add a null-check and stricter validation on properties, preventing the processing of malformed data that could contain XSS payloads. This hardening indirectly mitigates the vulnerability.
How do I update the plugin to fix the vulnerability?
Update instructions
Navigate to your WordPress admin dashboard, go to Plugins, and update Loco Translate to version 2.8.8 or later. If automatic updates are not enabled, you can download the latest version from the WordPress plugin repository and upload it manually. Always back up your site before updating.
Are there any temporary mitigations if I cannot update immediately?
Mitigation options
If you cannot update right away, restrict translator-level access to trusted users only. Additionally, avoid viewing PO files from untrusted sources and consider using a Web Application Firewall (WAF) to filter malicious payloads. However, updating to the patched version is the only complete fix.
What is the root cause of the vulnerability?
Root cause analysis
The root cause is insufficient input sanitization and output escaping of PO file extracted comments. The plugin processes and displays these comments without properly validating or escaping them, allowing malicious scripts to be injected and executed in the admin context.
Can this vulnerability be exploited remotely?
Exploitability
No, the vulnerability requires authentication. An attacker must have at least translator-level access to the WordPress site, which means they need valid credentials. This reduces the attack surface but still poses a risk in multi-user environments where translators may not be fully trusted.
What should I do if I suspect my site has been compromised?
Incident response
If you suspect exploitation, immediately update the plugin to version 2.8.8 or later, change all admin and translator passwords, and review user accounts for unauthorized changes. Scan your site for malicious code and consider restoring from a clean backup if necessary. Monitor logs for suspicious activity.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started