CVE-2026-97279
MediumCVSS 6.5Summary
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
Risk Assessment
A low-privileged user can execute malicious code in other users' browsers, potentially leading to session data theft or content modification.
Recommendation
Update the Polylang plugin to a version later than 3.8.9 to remove the XSS vulnerability.
Other vulnerabilities in Polylang
See all- CVE-2026-39783Medium
Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.
- CVE-2026-65458Medium
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS