CVE

CVE-2022-0765

5.4

CVSS

Description

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.

Attack Vector

Privileges Req.

User Interaction

loco translate

Updated Sep 26, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2022-0765 Scanner

CVE-2022-0765 Scanner - Cross-Site Scripting vulnerability in WordPress Loco Translate

Used 3.3k times · 3.3k assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: loco translate

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →