Vulnerabilities

TI-2026-86549 CVE-2026-118047 · GHSA-hcpg-c6qf-x673

Stored cross-site scripting in Falang multilanguage for WordPress

LOW 28

The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'falang_term[<taxonomy>][<locale>][<field>] (via order[] driving wp_update_term)' parameter in all versions…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00357 Published 2026-11-07 No fix listed CWE-79

TI-2026-39608 CVE-2026-54805 · GHSA-ch7m-79px-p832

WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability

MEDIUM 40

Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00378 Published 2026-06-17 No fix listed CWE-266

TI-2025-36287 CVE-2025-58619 · GHSA-5376-r6x9-788p

WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability

MEDIUM 40

Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through <= 1.3.65.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00403 Published 2025-11-06 No fix listed CWE-502

TI-2025-30611 CVE-2025-48285 · GHSA-pvr2-jc9j-hvv3

WordPress Falang multilanguage plugin <= 1.3.61 - Cross Site Request Forgery (CSRF) Vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.61.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00151 Published 2025-05-19 No fix listed CWE-352

TI-2024-24755 CVE-2024-37240 · GHSA-4777-367v-cc98

WordPress Falang multilanguage for WordPress plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability

LOW 19

Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.51.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.002 Published 2025-01-02 No fix listed CWE-352

TI-2024-04108 CVE-2024-4417 · GHSA-x92j-58cf-374g

Falang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scripting

LOW 20

The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.49 due to insufficient input sanitization and output e…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.0035 Published 2024-05-10 No fix listed CWE-79