CVE-2026-15066

The Loco Translate plugin for WordPress contains a vulnerability that allows attackers with translator-level access to inject malicious code into translated content. This code can then be executed when a user views the affected page, potentially leading to unauthorized actions or data theft. The issue arises from inadequate filtering of user input and insufficient protection against cross-site scripting attacks.

Based on public CVE data (MITRE/NVD).