CVE-2026-88784 – The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the

The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.