CVE-2026-94239 is a stored XSS vulnerability in the Loco Translate WordPress plugin prior to version 2.8.9. The plugin fails to properly sanitize and escape certain bundle configuration values before rendering them on an administrative page. Users with translator capability or higher can exploit this to inject persistent malicious scripts that execute in the browsers of administrators or other high privilege users viewing the affected page.

Successful exploitation allows an attacker with translator-level access to execute arbitrary JavaScript in the context of high privilege users, potentially leading to session hijacking, privilege escalation, or other administrative actions performed by the victim user. The impact is limited to users with elevated privileges viewing the affected admin page.

Upgrade the Loco Translate plugin to version 2.8.9 or later, where this vulnerability has been fixed. No other mitigation is indicated or required as the issue is resolved in the updated version.