What is GHSA-v5cq-8fvv-9wcc?

GHSA-v5cq-8fvv-9wcc is a security advisory published by GitHub Security Advisories with High severity. The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs...

Which CVE IDs does GHSA-v5cq-8fvv-9wcc cover?

GHSA-v5cq-8fvv-9wcc covers the following CVE IDs: CVE-2026-88784. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v5cq-8fvv-9wcc?

GHSA-v5cq-8fvv-9wcc has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-v5cq-8fvv-9wccHighCVSS 7.5

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-88784 →

📋 Description

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88784
https://wpscan.com/vulnerability/0a567730-5dd9-4bcb-b955-312979041466
https://github.com/advisories/GHSA-v5cq-8fvv-9wcc