Skip to content
PluginCanary

Loco Translate

by Tim W · 1,000,000+ active installs · Checked 3 Nov 2026
Watch3 Warnings

Watch: vulnerability published 1 Oct 2026, fixed in 2.8.9.

77/ 100 Canary Score
Sub-scores for Loco Translate
Ownership100
Maintenance100
Security65
Support27
Reputation75

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 2.8.9. Update to version 2.8.9 or later.1 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 2.8.9. Update to version 2.8.9 or later.1 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Aug 2026, fixed in 2.8.8. Update to version 2.8.8 or later.15 Aug 2026Evidence
  • InfoSEC-36 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence
  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
timwhitlock23 Jul 2013 to 12 Oct 2026, 884 commits

1 committer recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
35 days ago
Releases, 24 months
17
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Loco Translate
Q1 20241
Q2 20243
Q3 20241
Q4 20243
Q1 20252
Q2 20253
Q3 20250
Q4 20250
Q1 20263
Q2 20262
Q3 20264
Q4 20260

Last release 30 Sep 2026. Tested with WordPress 7.1 (current).

Support

27% of 11 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
1 Oct 2026Loco Translate <= 2.8.8 - Authenticated (Translator+) Stored Cross-Site Scripting6.4<= 2.8.82.8.90
1 Oct 2026Loco Translate <= 2.8.8 - Authenticated (Translator+) Limited File Read4.3<= 2.8.82.8.90
15 Aug 2026Loco Translate <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments6.4<= 2.8.72.8.80
15 Jul 2026Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter8.8<= 2.8.52.8.60
4 May 2026Loco Translate <= 2.8.2 - Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter4.9<= 2.8.22.8.30
30 Mar 2026Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter6.1<= 2.8.22.8.30
21 Jun 2024Loco Translate <= 2.6.9 - Cross-Site Request Forgery4.3<= 2.6.92.6.100
22 Mar 2022Loco Translate <= 2.6.0 - Authenticated Stored Cross-Site Scripting6.4< 2.6.12.6.10
11 Oct 2021Loco Translate <= 2.5.3 - Authenticated PHP Code Injection6.5< 2.5.42.5.40

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Loco Translate
Q3 20241.0
Q4 20244.6
Q1 20253.7
Q2 20255.0
Q3 20255.0
Q4 20255.0
Q1 20264.6
Q2 20265.0
Q3 20265.0

Average rating rose from 1.0 to 5.0 between Q3 2024 and Q3 2026.

Rating distribution
5 star424
4 star5
3 star4
2 star4
1 star16
Latest low reviews

Momentum

1,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Loco Translate
4 May 202640,368
11 May 202672,779
18 May 202688,262
25 May 202652,034
1 Jun 2026431,188
8 Jun 202692,482
15 Jun 202665,760
22 Jun 202653,309
29 Jun 202648,512
6 Jul 2026279,396
13 Jul 2026574,122
20 Jul 2026107,810
27 Jul 2026366,639
3 Aug 2026189,517
10 Aug 202679,939
17 Aug 202669,798
24 Aug 202657,551
31 Aug 202648,376
7 Sep 202639,663
14 Sep 202638,149
21 Sep 202638,336
28 Sep 2026398,900
5 Oct 2026151,549
12 Oct 202667,886
19 Oct 202676,154
26 Oct 202658,383
2 Nov 20267,768

Weekly downloads over the last 4 weeks are 61% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Translate WordPress with GTranslateScore 95 · 900,000+Translate WordPress - Google Language TranslatorScore 93 · 100,000+ووکامرس فارسی | فارسی و شمسی ساز وردپرس و ووکامرسScore 93 · 100,000+LocoAI - Auto Translate for Loco TranslateScore 93 · 70,000+Say What?Score 93 · 40,000+

Facts

Version2.8.9
AuthorTim W
Added23 Jul 2013
Last updated30 Sep 2026
Active installs1,000,000+
Requires WordPress6.6
Tested up to7.1.4
Requires PHP7.4
CategoryMultilingual & Accessibility > Translation & Multilingual Management
Tagsi18n, l10n, language, translation, multilingual

Questions

Is Loco Translate still maintained?

Loco Translate was last updated on 30 Sep 2026. Its Canary status is Watch.

Is Loco Translate safe?

Loco Translate has no open unpatched vulnerabilities on record. 6 vulnerabilities were published in the last 24 months. Its Canary status is Watch.

Who owns Loco Translate?

The wordpress.org author is Tim W. Recent committers: timwhitlock, plugin-master. We have recorded no ownership change.

What can I use instead of Loco Translate?

Plugins in the same category with a higher Canary Score: Translate WordPress with GTranslate, Translate WordPress - Google Language Translator, ووکامرس فارسی | فارسی و شمسی ساز وردپرس و ووکامرس, LocoAI - Auto Translate for Loco Translate, Say What?.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue