WordPress Plugin Vulnerabilities

Falang multilanguage for WordPress < 1.3.18 - Reflected Cross-Site Scripting

Description

The plugin does not escape the page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site scripting issue

Proof of Concept

Affects Plugins

Plugin icon
falang
Fixed in 1.3.18

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
853fc9a7-4edf-4fe1-8e0c-d50c78b48faa

Timeline

Publicly Published
2021-10-25 (about 4 years ago)
Added
2021-10-25 (about 4 years ago)
Last Updated
2021-10-25 (about 4 years ago)

Other

Published
Title
Published
2022-04-11
Title
Adrotate < 5.8.23 - Admin+ XSS via Advert Name
Published
2024-09-27
Title
GTM Server Side < 2.1.20 - Reflected Cross-Site Scripting
Published
2025-06-25
Title
Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module
Published
2024-06-22
Title
SULly < 4.3.1 - Admin+ Stored XSS via CSRF
Published
2025-04-04
Title
Advanced Woo Labels < 2.16 - Contributor+ Stored XSS