{"id":"CVE-2026-105262","kind":"vulnerability","aliases":["CVE-2026-105262"],"related":[],"title":"Falang WordPress plugin: subscribers can store scripts that run for admins","description":"The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.","summary":"The Falang multilanguage plugin for WordPress before 1.4.6 saves term translations without a capability check and exposes a valid nonce to any logged-in user. A Subscriber can store content that is later output unescaped, so the script runs in the browser of higher-privileged users such as administrators.","severity":"high","cvss":8.0,"epss":0.00304,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["falang","package","wordpress","wordpress-plugin"],"not_affected_if":["closed-registration","plugin-not-installed"],"how_to_check":"- Check the installed Falang version in the WordPress admin plugin list or `wp plugin get falang --field=version` and compare it to `1.4.6`.\n- Review user roles for accounts that can register or log in as Subscriber on the site.","fix":"- Update the Falang multilanguage plugin to `1.4.6` or later.\n- Review stored term translations for unexpected script content after updating.","status":"open","published_at":"2026-10-21T06:16:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:07:55+00:00","updated_at":"2026-10-25T03:07:55+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:07:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Falang multilanguage plugin to `1.4.6` or later.\n- Review stored term translations for unexpected script content after updating.","reach":"internet","title":"Falang WordPress plugin: subscribers can store scripts that run for admins","impact":"high","summary":"The Falang multilanguage plugin for WordPress before 1.4.6 saves term translations without a capability check and exposes a valid nonce to any logged-in user. A Subscriber can store content that is later output unescaped, so the script runs in the browser of higher-privileged users such as administrators.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","falang"],"confidence":0.7,"needs_auth":"yes","worst_case":"Stored script runs in administrators' browsers, enabling account takeover.","analyst_note":"","how_to_check":"- Check the installed Falang version in the WordPress admin plugin list or `wp plugin get falang --field=version` and compare it to `1.4.6`.\n- Review user roles for accounts that can register or log in as Subscriber on the site.","needs_analyst":false,"not_affected_if":["plugin-not-installed","closed-registration"],"who_is_affected":"Sites running the Falang multilanguage plugin before 1.4.6 where anyone can log in with a Subscriber-level account, such as sites with open registration. Sites that do not use the plugin, or that only allow trusted users to log in, are less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000607,"input_tokens":3388,"output_tokens":537,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105262':14A,17A '-2026':13A,16A '1.4.6':31B,82C 'access':114C 'admin':11A 'administr':74B,146C 'allow':108C 'browser':66B 'capabl':37B,87C 'check':38B,88C 'content':54B,119C 'context':138C 'cross':131C 'cross-sit':130C 'cve':12A,15A 'escap':126C 'execut':135C 'expos':40B,94C 'falang':1A,18B,25B,76C 'handler':107C 'higher':69B,141C 'higher-privileg':68B,140C 'later':57B,122C 'lead':127C 'level':113C 'log':47B,101C 'logged-in':46B,100C 'multilanguag':26B,77C 'nonc':43B,97C 'output':58B,123C 'packag':19B 'perform':85C 'plugin':3A,23B,27B,80C 'privileg':70B,142C 'proper':125C 'run':9A,63B 'save':32B,90C 'script':7A,62B,133C 'site':132C 'store':6A,53B,118C,129C 'subscrib':4A,51B,112C 'subscriber-level':111C 'term':33B,91C 'translat':34B,92C 'unescap':59B 'unprotect':106C 'user':49B,71B,103C,109C,143C 'valid':42B,96C 'without':35B,124C 'wordpress':2A,20B,22B,29B,79C 'wordpress-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Falang multilanguage plugin before 1.4.6 where anyone can log in with a Subscriber-level account, such as sites with open registration. Sites that do not use the plugin, or that only allow trusted users to log in, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105262","severity":null,"published_at":"2026-10-21T06:16:46+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105262","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105262","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}