WordPress Plugin Vulnerabilities

WPML Multilingual CMS < 4.6.1 - Reflected Cross-Site Scripting

Description

The plugin does not escape some URL attributes before outputting them to a page, leading to a Reflected Cross-Site Scripting vulnerability.

Proof of Concept

Affects Plugins

Plugin icon
sitepress-multilingual-cms
Fixed in 4.6.1

References

URL
https://wpml.org/changelog/2023/03/wpml-4-6-1-important-security-update/
URL
https://wpml.org/forums/topic/the-wpml-plugin-is-vulnerable-to-cross-site-scripting-xss-via-the-wp_lang-quer/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Submitter
Deepak kumar, 0xcharan
Verified
Yes
WPVDB ID
b9cc519c-7ec2-42c3-9f42-01e928e12139

Timeline

Publicly Published
2023-04-16 (about 2 years ago)
Added
2023-05-03 (about 2 years ago)
Last Updated
2023-05-04 (about 2 years ago)

Other

Published
Title
Published
2025-10-24
Title
Widget Options – The #1 WordPress Widget & Block Control Plugin < 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-12-19
Title
Insert or Embed Articulate Content into WordPress < 4.3000000023 - Contributor+ Stored XSS
Published
2025-04-17
Title
WP Post to PDF Enhanced <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2022-04-05
Title
Ad Invalid Click Protector (AICP) < 1.2.7 - Reflected Cross-Site Scripting
Published
2023-10-02
Title
Dreamfox Media Payment gateway per Product for Woocommerce < 3.2.8 - Reflected XSS