Live › vulnerability › CVE-2026-105262
Go to dashboardThe Falang multilanguage plugin for WordPress before 1.4.6 saves term translations without a capability check and exposes a valid nonce to any logged-in user. A Subscriber can store content that is later output unescaped, so the script runs in the browser of higher-privileged users such as administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Falang multilanguage plugin before 1.4.6 where anyone can log in with a Subscriber-level account, such as sites with open registration. Sites that do not use the plugin, or that only allow trusted users to log in, are less exposed.
No product ranges from the sources yet.
wp plugin get falang --field=version and compare it to 1.4.6.1.4.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-105262")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.