Plugin icon

WPML

sitepress-multilingual-cms

Vulnerabilities:

10

Last Updated:

March 9, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2025-05-01
Title
WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode
Fixed in
Fixed in 4.7.4
CVSS
6.4 (medium)
Published
2024-08-21
Title
WPML Multilingual CMS < 4.6.13 - Contributor+ RCE via Twig Server-Side Template Injection
Fixed in
Fixed in 4.6.13
CVSS
9.1 (critical)
Published
2023-04-16
Title
WPML Multilingual CMS < 4.6.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.6.1
CVSS
7.1 (high)
Published
2022-11-09
Title
WPML < 4.5.14 - CSRF
Fixed in
Fixed in 4.5.14
CVSS
4.3 (medium)
Published
2022-11-09
Title
WPML < 4.5.11 - Subscriber+ Translation Job Status Update
Fixed in
Fixed in 4.5.11
CVSS
4.3 (medium)
Published
2022-11-09
Title
WPML < 4.5.11 - Subscriber+ Settings Update
Fixed in
Fixed in 4.5.11
CVSS
4.3 (medium)
Published
2020-03-09
Title
WPML < 4.3.7 - Authenticated Cross Site Request Forgery leading to Remote Code Execution
Fixed in
Fixed in 4.3.7
CVSS
8.8 (high)
Published
2018-10-08
Title
WPML < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 4.0
CVSS
6.1 (medium)
Published
2015-09-02
Title
WPML 2.9.3-3.2.6 - Cross-Site Scripting (XSS) in Accept-Language Header
Fixed in
Fixed in 3.2.7
CVSS
6.1 (medium)
Published
2015-03-12
Title
WPML < 3.1.9 - Multiple Vulnerabilities (Including SQLi)
Fixed in
Fixed in 3.1.9
CVSS
n/a