Live › vulnerability › CVE-2023-54413
Go to dashboardWPML Multilingual CMS for WordPress before 4.6.1 reflects the wp_lang parameter into the login page without escaping. An unauthenticated attacker who lures a user to a crafted /wp-login.php link can run JavaScript in that user's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WPML Multilingual CMS plugin at a version before 4.6.1 are exposed, since the flaw sits in the login page the plugin serves. Sites without WPML, or with it at 4.6.1 or later, are not affected.
No product ranges from the sources yet.
wp-content/plugins/sitepress-multilingual-cms/sitepress.php4.6.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
This page as .md · .json · in your agent: get_signal("CVE-2023-54413")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.