CVE-2021-24721CWE-94

CVE-2021-24721: vulnerability in Loco Translate

Loco Translate < 2.5.4 - Authenticated PHP Code Injection

Published · Updated

Follow this CVE+ Monitor Loco Translate

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.9%
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.
Affected products
Unknown · Loco Translate
Related CVEs — Loco Translate

In the same product, most dangerous first.

CVE-2022-0765—Loco Translate < 2.6.1 - Authenticated Stored Cross-Site ScriptingEPSS 3.8%CVE-2026-94238MEDIUMLoco Translate < 2.8.9 - Translator+ Limited File Read via 'path' ParameterEPSS 0.3%CVE-2026-94239MEDIUMLoco Translate < 2.8.9 - Translator+ Stored XSS via Bundle ConfigurationEPSS 0.2%