Published October 21, 2026. Based on public reports available on that date; details may change.
CVE-2026-88784 is a stored cross-site scripting issue in Weglot before version 6.4.3. The plugin does not escape URLs it reinserts while rewriting translated-page links, which can let an unauthenticated attacker store a payload that runs in a browser viewing a translated page. Update to 6.4.3 or later and review untrusted translated content and links.
What happened
The public description identifies unsafe URL escaping during translated-page link rewriting. WordPress plugins often need to change links as they build a page in another language. If a URL inserted back into the page is not escaped correctly, browser-interpreted content can be stored and later run when someone visits the translated page.
This is described as stored cross-site scripting. Unlike a one-time reflected value, stored content can remain associated with the site until it is removed or corrected. The report says an unauthenticated attacker can store a payload that executes in a browser viewing the translated page.
The cited records do not report exploitation in the wild. That does not remove the need to patch, particularly for sites that publish content from contributors, accept submissions, or have other ways for untrusted material to influence translated pages.
Who is affected
Weglot versions before 6.4.3 are affected. Version 6.4.3 is the stated fixed version. Update to 6.4.3 or later, rather than treating the version as merely a threshold to pass.
Open the WordPress dashboard and select Plugins to find the installed version. Check every site and environment using the plugin. A staging site with real content deserves attention too, especially if it is publicly available or shares credentials and services with production.
For a command-line inventory, use this from the WordPress installation directory:
wp plugin list --format=table
The output identifies installed plugins, their versions, and update state. Preserve a copy before updating, then produce a new copy afterward. This simple step helps avoid the common mistake of confirming only that an update was available, not that it was installed.
How to review translated content
Start with pages where a visitor can encounter translated links. Review the translated versions of recently added or edited content, with particular attention to links that were supplied by an outside contributor or pulled from untrusted text. Do not click an unexpected link while signed in as an administrator. Open it only after you have verified it is appropriate for the site.
Look for content and links that do not fit the page, language, or business purpose. Preserve the page URL, the relevant content, and the time you found it before removing anything. The CVE does not say that every unusual link is an attack, but keeping an accurate record makes a later review more reliable.
Check the site's accounts as well. In Users, confirm there are no unknown administrators, editors, or contributors who can change content. From WP-CLI, this command produces a useful list:
wp user list --fields=ID,user_login,user_email,roles,user_registered --format=table
If you find unexpected accounts or page changes, use our guidance on how to scan WordPress for malware and signs a WordPress site has been hacked to structure the next checks.
What to do now
Take a current backup of WordPress files and the database, then update Weglot to 6.4.3 or later. In the dashboard, open Plugins, update the plugin, and confirm the displayed version when it finishes. Test a representative translated page and its ordinary links after the update.
On a site managed with WP-CLI, see available plugin updates with:
wp plugin list --update=available --format=table
After a tested backup, wp plugin update --all installs available updates for all plugins. Because that is broader than this advisory, use it only within your normal maintenance process. Follow it with wp plugin list --format=table and confirm the Weglot plugin is at 6.4.3 or later.
Reduce future exposure by limiting who can alter content, keeping a record of updates, and reviewing content flows that accept information from outside the business. Our WordPress hardening checklist is a useful baseline. If suspicious content persists after the update, do not simply remove the visible page and stop there, because an underlying account or site change may need review.
When to get help
Get help if you find unexpected translated-page content, cannot identify its source, or suspect administrators have viewed a malicious page while signed in. WordPress malware removal can help when there are signs of alteration, and WordPress hardening can address broader configuration gaps.