Translate WordPress and go Multilingual Vulnerability– Weglot – Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes – CVE-2024-2124 | WordPress Plugin Vulnerability Report

Plugin Name: Translate WordPress and go Multilingual – Weglot

Key Information:

  • Software Type: Plugin
  • Software Slug: weglot
  • Software Status: Active
  • Software Author: remyb92
  • Software Downloads: 2,296,771
  • Active Installs: 60,000
  • Last Updated: March 19, 2024
  • Patched Versions: 4.2.6
  • Affected Versions: <= 4.2.5

Vulnerability Details:

  • Name: Translate WordPress and go Multilingual – Weglot <= 4.2.5
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2124
  • CVSS Score: 6.4
  • Publicly Published: March 19, 2024
  • Researcher: Ngô Thiên An (ancorn_) - VNPT-VCI
  • Description: Weglot, a plugin designed to make WordPress websites multilingual, was found to be vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 4.2.5. The vulnerability stemmed from insufficient sanitization of user-supplied attributes like 'className' in the plugin's widget/block. This allowed authenticated users with contributor-level permissions or higher to execute arbitrary web scripts on affected pages.


Translate WordPress and go Multilingual – Weglot plugin harbored a critical security vulnerability in versions up to 4.2.5, identified as CVE-2024-2124. This Stored Cross-Site Scripting flaw, stemming from improperly sanitized block attributes, has been effectively addressed in the recently released 4.2.6 update.

Detailed Overview:

The discovery of this vulnerability by researcher Ngô Thiên An from VNPT-VCI highlights the intricate challenges of ensuring plugin security. Authenticated users with at least contributor privileges were able to exploit this flaw to inject harmful scripts into web pages, posing potential risks to website integrity and user safety. The quick release of a patched version underscores the severity of the vulnerability and the need for immediate action from website administrators.

Advice for Users:

  • Immediate Action: Users are urged to update their Weglot plugin to version 4.2.6 without delay to protect their sites from potential exploitation.
  • Check for Signs of Vulnerability: Administrators should review their websites for any unusual or unauthorized script injections, particularly in pages utilizing Weglot's translation widgets or blocks.
  • Alternate Plugins: While the Weglot plugin has been patched, users might consider exploring other reputable translation plugins as a precautionary measure, ensuring a diverse toolkit for website functionality.
  • Stay Updated: Consistently updating all WordPress components, including plugins, is crucial for maintaining a secure and efficient website. Regularly monitoring for updates can prevent vulnerabilities from being exploited.


The prompt remediation of CVE-2024-2124 within the Weglot plugin serves as a crucial reminder of the dynamic nature of web security. As WordPress continues to power a significant portion of the web, the vigilance of both developers and users in maintaining plugin security is paramount. By staying informed and proactive, website owners can ensure their digital presence remains both functional and secure.


Detailed Report: 

In the vast expanse of the digital world, your website acts as a crucial interface connecting your business with the global audience. With the power of WordPress and its myriad plugins, like Translate WordPress and go Multilingual – Weglot, creating a multilingual website has never been easier. However, the recent discovery of a vulnerability, CVE-2024-2124, in the Weglot plugin reminds us of the delicate balance between functionality and security. This incident highlights the imperative need for regular updates and vigilant security practices to safeguard your digital presence.

Translate WordPress and go Multilingual – Weglot: An Overview

Weglot has emerged as a preferred solution for WordPress users aiming to make their sites accessible to a global audience by breaking language barriers. Developed by remyb92, this plugin boasts over 2 million downloads and 60,000 active installations, a testament to its popularity and utility. Despite its widespread use, Weglot was found to have a critical vulnerability in versions up to and including 4.2.5, which was promptly addressed in the patched version 4.2.6.

Vulnerability Insight: CVE-2024-2124

CVE-2024-2124 exposes a Stored Cross-Site Scripting (XSS) vulnerability within Weglot, stemming from inadequate sanitization of user-supplied attributes, notably 'className', in the plugin's widgets or blocks. This flaw allowed authenticated users with contributor-level access or higher to inject and execute arbitrary web scripts on web pages, compromising site security and user safety. This vulnerability was brought to light by security researcher Ngô Thiên An from VNPT-VCI, underscoring the ongoing challenges in securing complex web applications.

Potential Risks and Remediation

The presence of CVE-2024-2124 posed significant risks, including unauthorized access, data breaches, and the undermining of user trust. To mitigate these risks, Weglot users are strongly encouraged to update their plugin to version 4.2.6, which contains the necessary fixes. Additionally, website administrators should conduct thorough reviews for any unauthorized script injections and maintain stringent user role management to prevent exploitation.

Historical Context and Proactive Measures

This isn't the first time Weglot has encountered security vulnerabilities, with previous issues also duly addressed by the developers. Such instances serve as a reminder of the ever-evolving nature of cybersecurity threats and the critical importance of maintaining up-to-date software.

The Imperative of Vigilance

For small business owners, the security of your WordPress website is paramount, not just for safeguarding data but also for preserving your brand's reputation. The incident with Weglot's CVE-2024-2124 vulnerability reinforces the need for constant vigilance, regular updates, and a proactive stance on security. In the digital age, staying informed about potential vulnerabilities and adopting best security practices is essential for ensuring the longevity and success of your online presence. By prioritizing security, you not only protect your business but also build trust with your audience, a cornerstone of digital success.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Translate WordPress and go Multilingual Vulnerability– Weglot – Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes – CVE-2024-2124 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment