Loco Translate

Loco Translate has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (43%). Other recurring categories include Cross-Site Request Forgery (CSRF), Code Injection.

Every one of the 7 issues recorded for Loco Translate has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, one record each. Loco Translate is installed on roughly 1,000,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage100%
Open

0

Fixed

7

Get automatic notifications for all Loco Translate vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-15005

Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter

Read the full analysis

Vulnerability Records

7 records
Loco Translate banner
Latestv2.8.8

Loco Translate

Tim W

Author

Tim W

4.8(452)
96/100
Last Updated
2026-08-01 (1mo ago)
Active Installs
1,000,000+
Downloads
38,061,985
Requires WP
6.6+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2013-07-23 (13y ago)

Loco Translate provides in-browser editing of WordPress translation files and integration with automatic translation services. It also provides Gettext/localization tools for developers, such as extracting strings and generating templates. Features include: Built-in translation editor within WordPress admin Integration with translation APIs including DeepL, Google, Lecto, Microsoft and OpenAI. Create and update language files directly in your theme or plugin Extraction of translatable strings from your source code Native MO file compilation without the need for Gettext on your system JSON (Jed) file compilation compatible with WordPress script localization Support for standard PO features including comments, references and plural forms PO source view with clickable source code references Protected language directory for saving custom translations Configurable PO file backups with diff and restore capability Built-in WordPress locale codes Official Loco WordPress plugin by Tim Whitlock. For more information please visit our plugin page. Keyboard shortcuts The PO file editor supports the following keyboard shortcuts for faster translating: Done and Next: Ctrl ↵ Next string: Ctrl ↓ Previous string: Ctrl ↑ Next untranslated: Shift Ctrl ↓ Previous untranslated: Shift Ctrl ↑ Copy from source text: Ctrl B Clear translation: Ctrl K Toggle Fuzzy: Ctrl U Save PO / compile MO: Ctrl S Toggle invisibles: Shift Ctrl I Suggest translation: Ctrl J Mac users can use ⌘ Cmd instead of Ctrl.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C