WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- StatusPublished → DeferredNVD modified 2026-10-22 17:40
- StatusReceived → PublishedNVD modified 2026-10-22 10:57
- First seenCVSS 5.1NVD modified 2026-10-22 11:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 4
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wpml-multilingual-cms-xss.yaml
- https://wpml.org/changelog/2023/03/wpml-4-6-1-important-security-update/
- https://wpscan.com/vulnerability/b9cc519c-7ec2-42c3-9f42-01e928e12139/
- https://www.vulncheck.com/advisories/wpml-multilingual-cms-wordpress-plugin-4.6.1-reflected-xss-via-wp-login-php-wp-lang