CVE-2026-105262
Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
| Vendor | unknown |
| Product | falang multilanguage for wordpress |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown falang multilanguage for wordpress
Be the first to know when new unknown vulnerabilities affecting unknown falang multilanguage for wordpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Falang multilanguage for WordPress
0 < 1.4.6
References
Credits
Seongwon Lee WPScan