CVE-2023-54413
WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang
OnTheGoSystems WPML Multilingual CMS
CVSS
5.1MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.6.1WPML Multilingual CMSCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
Text from CVE List
Affected versions 1
- WPML Multilingual CMSaffected: all versions before 4.6.1CVE List
References 4
- wpml.org/changelog/2023/03/wpml-4-6-1-important-security-update/Fixvia CVE List
- wpscan.com/vulnerability/b9cc519c-7ec2-42c3-9f42-01e928e12139/Advisoryvia CVE List
- vulncheck.com/advisories/wpml-multilingual-cms-wordpress-plugin-4.6.1-reflected-xss-via-wp-login-php-wp-langAdvisoryvia CVE List
- github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wpml-multilingual-cms-xss.yamlReferencevia CVE List