CVE-2023-54413
MediumCVSS 6.1Summary
The WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser.
Risk Assessment
This enables execution of malicious code in the user's browser, potentially leading to session or credential theft.
Recommendation
Update the WPML Multilingual CMS plugin to version 4.6.1 or later.
Other vulnerabilities in WPML Multilingual CMS
See all- CVE-2026-17509Medium
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the 'elementIds' parameter in all versions up to and including 4.9.5 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Subscriber-level access and above to append additional SQL queries to extract sensitive information from the database. The vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user to access administrative translation functionalities.
- CVE-2026-12248Medium
The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL injection via the 'sorting' parameter in all versions up to and including 4.9.5 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with translator-level access and above to append additional SQL queries to extract sensitive information from the database.
Original NVD description (English source)
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS