All vulnerabilities
CVE-2026-105262

Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

Unknown Falang multilanguage for WordPressApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.4.6Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1.4.6Falang multilanguage for WordPressCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.

Text from CVE List

Affected versions 1

  • Falang multilanguage for WordPressaffected: all versions before 1.4.6CVE List

References 1