Loco Translate

WordPress plugin · loco-translate · WordPress.org ↗

Latest v2.8.8 Last release Aug 1, 2026 Tested up to WP 7.0.5 1,000,000+ active installs

Critical

High

Known total

Unfixed

Running Loco Translate on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 8.8	Loco Translate [loco-translate] < 2.8.6 WPVulnerability	< 2.8.6	v2.8.6	CVE-2026-15005	Jul 15, 2026
MEDIUM CVSS 6.4	Loco Translate [loco-translate] < 2.8.8 WPVulnerability	< 2.8.8	v2.8.8	CVE-2026-15066	Aug 15, 2026
MEDIUM CVSS 4.9	Loco Translate [loco-translate] < 2.8.3 WPVulnerability	< 2.8.3	v2.8.3	CVE-2026-1921	May 4, 2026
MEDIUM CVSS 4.3	Loco Translate [loco-translate] < 2.6.10 WPVulnerability	< 2.6.10	v2.6.10	CVE-2024-37236	Jun 21, 2024
MEDIUM CVSS 5.4	Loco Translate [loco-translate] < 2.6.1 WPVulnerability	< 2.6.1	v2.6.1	CVE-2022-0765	Mar 22, 2022
MEDIUM CVSS 6.5	Loco Translate [loco-translate] < 2.5.4 WPVulnerability	< 2.5.4	v2.5.4	CVE-2021-24721	Oct 11, 2021
UNKNOWN	Loco Translate [loco-translate] < 2.8.3 WPVulnerability	< 2.8.3	v2.8.3	CVE-2026-4146	Mar 30, 2026
UNKNOWN	Loco Translate [loco-translate] < 2.2.2 WPVulnerability	< 2.2.2	v2.2.2	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.