CVE-2026-15066 is a stored cross-site scripting vulnerability (CWE-79) in the Loco Translate plugin for WordPress. The flaw exists in the handling of PO file extracted comments, where insufficient input sanitization and output escaping allow authenticated users with translator-level permissions or above to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 2.8.7.

An attacker with translator-level or higher access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict translator-level access to trusted users only and consider monitoring for suspicious activity related to PO file comments. Follow official vendor updates for patches or temporary fixes.