Read the docs
TI-2023-30891 Aliases CVE-2023-54413GHSA-p7q8-6fx6-c54g

Reflected cross-site scripting in WPML Multilingual CMS for WordPress

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting flaw (CWE-79) because the wp_lang parameter is not neutralized before it is output. An unauthenticated remote attacker can lure a user to /wp-login.php with a crafted wp_lang value to run JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed WPML Multilingual CMS (OnTheGoSystems): 4.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OnTheGoSystemsWPML Multilingual CMSbefore 4.6.14.6.1Patch availableCNA
  • WPML Multilingual CMS VendorOnTheGoSystems Affected before 4.6.1 Fixed in 4.6.1 Patch available CNA

Remediation

Update WPML Multilingual CMS to version 4.6.1, which is the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA WPML Multilingual CMS (OnTheGoSystems) Fixed in 4.6.1

Timeline

  1. 2026-10-22 Threatist record created from CVE-2023-54413
  2. 2026-10-22 Alias added: GHSA-p7q8-6fx6-c54g
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: LOW → MEDIUM

References

Advisory 2

Other 1

  • TI-2020-08483 The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due… CVSS 3.1HIGH 8.8
  • TI-2024-29595 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-20192 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
  • TI-2022-22162 WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-21489 WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerability CVSS 3.1HIGH 7.6
  • TI-2023-12172 WordPress Toolset Types plugin <= 3.4.17 - Authenticated Arbitrary File Upload Vulnerability CVSS 3.1HIGH 7.2
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences