Answer in brief
CVE-2026-88784 records a High severity (CVSS 7.5) vulnerability in Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting. The current sources do not mark it as known exploited. The current feed maps Unknown/Translate WordPress with Weglot 2.0 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Translate WordPress with Weglot 2.0 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Translate WordPress with Weglot 2.0generic | >=0 <6.4.3 | 6.4.3 |
Published upstream
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 21, 2026
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
Quoted source text, attributed separately from HOL analysis.