timwhitlock

Products

Product	CVEs	Exploited	Latest
Loco Translate	4	–	Aug 16, 2026

CVE-2026-15066 Medium 6.4 Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments 0.4%
CVE-2026-15005 High 8.8 Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter 0.3%
CVE-2026-1921 Medium 4.9 Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter 0.6%
CVE-2026-4146 Medium 6.1 Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter 0.3%