Vulnerabilities

TI-2026-84146 CVE-2026-120563 · GHSA-2r9f-5mcx-5wjj

SQL injection in WPML Multilingual & Multicurrency for WooCommerce

LOW 22

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00301 Published 2026-11-03 No fix listed CWE-89

TI-2026-70422 CVE-2026-62130 · GHSA-99r3-v658-r3xf

Object injection in WooCommerce Multilingual & Multicurrency plugin

LOW 33

Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00291 Published 2026-10-10 No fix listed CWE-502

TI-2026-47379 CVE-2026-66711 · GHSA-wf57-jg94-8h6g

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability

LOW 31

Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-08-06 No fix listed CWE-79

TI-2025-28417 CVE-2025-43833 · GHSA-mhg9-c8wr-hm8x

WordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerability

LOW 33

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a throu…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00352 Published 2025-05-19 No fix listed CWE-89

TI-2025-19759 CVE-2025-26888 · GHSA-6fj3-j83w-3ppr

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.8 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in Amir Helzer WooCommerce Multilingual & Multicurrency woocommerce-multilingual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00285 Published 2025-04-09 No fix listed CWE-862

TI-2024-08005 CVE-2024-8629 · GHSA-35q7-h93f-grfr

WooCommerce Multilingual & Multicurrency with WPML <= 5.3.7 - Reflected Cross-Site Scripting

LOW 28

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00439 Published 2024-10-08 No fix listed CWE-79