CVE-2022-0765

Deeper analysis

The Loco Translate WordPress plugin before version 2.6.1 is affected by a stored cross-site scripting vulnerability. The root cause is insufficient sanitization of inline event handlers within source translation strings before they are rendered in the plugin's administrative editor interface. The issue is tracked as CWE-79 and carries a CVSS 3.1 score of 5.4.

Any authenticated user granted access to the plugin, such as those assigned the Translator or Administrator role, can inject arbitrary JavaScript payloads into translation strings. Successful exploitation results in persistent script execution in the browsers of other users who subsequently view the affected editor pages, enabling actions such as session hijacking or administrative interface manipulation within the same origin.

The referenced WPScan advisory identifies the flaw in versions prior to 2.6.1 and indicates that updating to the patched release addresses the input-handling deficiency. The EPSS score rose from a low baseline to a peak of 0.1081 before receding to its current value of 0.0274, indicating a period of increased exploitation interest after public disclosure.