Read the docs

WPML

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

WPML records in CISA KEV

No WPML vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wpml 11 records HIGH

Records

13 records

TI-2024-05928 CVE-2024-6386 · GHSA-q8gr-qpfg-hv8p

Code injection in WPML

Priority HIGH 76

The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.25533 Published 2024-08-21 No fix listed CWE-1336
TI-2015-02040 CVE-2015-2314 · GHSA-pqx7-h7jx-cfmc

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote…

Priority MEDIUM 43

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/f…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.06857 Published 2015-03-17 No fix listed CWE-89
TI-2018-12842 CVE-2018-18069 · GHSA-8r4w-5mm3-8jh9

process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for…

Priority MEDIUM 42

process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request t…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.13207 Published 2018-10-08 No fix listed CWE-79
TI-2015-02466 CVE-2015-2792 · GHSA-657c-v2h8-hpvj

The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a…

Priority LOW 39

The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POS…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03773 Published 2015-03-30 No fix listed CWE-284
TI-2026-14364 CVE-2026-17509 · GHSA-6xgg-64gv-xp85

WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’

Priority LOW 29

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parame…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00403 Published 2026-09-08 No fix listed CWE-89
TI-2026-10534 CVE-2026-12248 · GHSA-5h67-368c-x3f7

WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter

Priority LOW 29

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack o…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00451 Published 2026-08-15 No fix listed CWE-89
TI-2025-03066 CVE-2025-3488 · GHSA-mw23-vrfq-v3fh

Cross-site scripting in WPML

Priority LOW 28

The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6.0 - 4.7.3 due to insufficient input sanitization and output escaping on user su…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00306 Published 2025-05-02 No fix listed CWE-79
TI-2022-18085 CVE-2022-38461 · GHSA-9j68-9p63-wh2j

WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

Priority LOW 25

Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the d…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00556 Published 2022-11-17 No fix listed CWE-264
Open these records in search →