CVE-2026-15066 describes a stored cross-site scripting vulnerability in the Loco Translate WordPress plugin (timwhitlock) affecting all versions up to 2.8.7. The flaw is due to improper neutralization of input during web page generation, specifically in PO file extracted comments. Authenticated attackers with translator-level privileges or above can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact. No official patch or remediation guidance is currently provided by the vendor.

An attacker with translator-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages generated by the plugin. This can lead to partial compromise of confidentiality and integrity of affected users' sessions or data when they access the injected pages. There is no reported impact on availability. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict translator-level access to trusted users only and consider monitoring for suspicious activity related to PO file comments. Avoid exposing sensitive users to pages generated by the plugin if possible.