{"id":"CVE-2026-124410","kind":"vulnerability","aliases":["CVE-2026-124410"],"related":[],"title":"wpLingua WordPress plugin up to 3.1.1: unauthenticated stored XSS through comments","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua: from n/a through 3.1.1.","summary":"wpLingua (Translate and boost SEO - Automatic AI translation) up to and including 3.1.1 has a stored XSS flaw. According to a secondary write-up of WPSEC-2026-2763, an anonymous commenter can forge the parser's ___noise___ placeholder keys inside a comment attribute. The injected markup then runs for visitors of the translated page, administrators included. No exploitation reported.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wplingua","fixed":["3.2.0"],"affected":"<= 3.1.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["comments","other","stored-xss","unauthenticated","wordpress","wplingua","xss"],"not_affected_if":["comments-disabled","plugin-not-installed"],"how_to_check":"In WP admin > Plugins, check whether wpLingua is installed and its version is 3.1.1 or lower (WP-CLI: wp plugin get wplingua --field=version). Sites with comments open on translated pages are the main exposure. Search comments for the string ___noise___.","fix":"Update wpLingua to 3.2.0 or later (3.3.0 is current on WordPress.org). 3.2.0 as the fix version comes from a secondary source, RescuePHP. If you can't update, close comments or hold them for moderation.","status":"open","published_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","triaged_at":"2026-11-13T15:48:37+00:00","updated_at":"2026-11-13T15:51:13+00:00","category":"other","confidence":0.65,"triage":{"at":"2026-11-13T15:48:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"wpLingua WordPress plugin: stored XSS lets attackers inject scripts through translations","impact":"medium","summary":"The wpLingua Translation Service plugin for WordPress has a stored cross-site scripting flaw in versions up to 3.1.1. An attacker who can get content into the plugin can store script that runs in other visitors' browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wplingua"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, stealing sessions or data.","analyst_note":"Check the NVD entry and the plugin's WordPress.org changelog for a fixed version and the required privilege level for the stored injection.","how_to_check":"- Check whether the WordPress site runs the wpLingua plugin (Translate and boost SEO - Automatic AI translation - wpLingua) in the plugins list.\n- Compare the installed plugin version against `3.1.1`; anything at or below it is in the reported range.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the wpLingua plugin for WordPress up to version 3.1.1 are in the reported range. The sources do not say which user roles can inject the stored script or whether default settings are affected, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000741,"input_tokens":4600,"output_tokens":563,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin's WordPress.org changelog for a fixed version and the required privilege level for the stored injection.","search":"'-124410':14A,17A '-2026':13A,16A,55B '-2763':56B '3.1.1':6A,40B,130C 'accord':46B 'administr':83B 'affect':118C 'ai':34B,110C,124C 'allow':114C 'anonym':58B 'attribut':71B 'automat':33B,109C,123C 'boost':31B,107C,121C 'comment':11A,19B,59B,70B 'cross':97C 'cross-sit':96C 'cve':12A,15A 'exploit':86B 'flaw':45B 'forg':61B 'generat':95C 'improp':88C 'includ':39B,84B 'inject':73B 'input':91C 'insid':68B 'issu':117C 'key':67B 'markup':74B 'n/a':128C 'neutral':89C 'nois':65B 'page':82B,94C 'parser':63B 'placehold':66B 'plugin':3A 'report':87B 'run':76B 'script':99C 'secondari':49B 'seo':32B,108C,122C 'servic':104C 'site':98C 'store':8A,22B,43B,115C 'stored-xss':21B 'translat':29B,35B,81B,103C,105C,111C,119C,125C 'unauthent':7A,24B 'visitor':78B 'vulner':100C 'web':93C 'wordpress':2A,25B 'wplingua':1A,18A,26B,28B,102C,112C,113C,126C 'wpsec':54B 'write':51B 'write-up':50B 'xss':9A,23B,27B,44B 'xss.this':116C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running wpLingua 3.1.1 or lower that accept comments on pages rendered in translation. A secondary source says no account is needed to inject. Sites without the plugin, or with comments disabled, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wplingua"],"ptokens":["wplingua"],"labels":["comments","high","other","storedxss","unauthenticated","wordpress","wplingua","xss"],"campaign_type":null,"search_a":"'-124410':14A,17A '-2026':13A,16A '3.1.1':6A 'comment':11A 'cve':12A,15A 'plugin':3A 'store':8A 'unauthent':7A 'wordpress':2A 'wplingua':1A,18A 'xss':9A","search_b":"'-2026':55B '-2763':56B '3.1.1':40B 'accord':46B 'administr':83B 'ai':34B 'anonym':58B 'attribut':71B 'automat':33B 'boost':31B 'comment':19B,59B,70B 'exploit':86B 'flaw':45B 'forg':61B 'includ':39B,84B 'inject':73B 'insid':68B 'key':67B 'markup':74B 'nois':65B 'page':82B 'parser':63B 'placehold':66B 'report':87B 'run':76B 'secondari':49B 'seo':32B 'store':22B,43B 'stored-xss':21B 'translat':29B,35B,81B 'unauthent':24B 'visitor':78B 'wordpress':25B 'wplingua':26B,28B 'wpsec':54B 'write':51B 'write-up':50B 'xss':23B,27B,44B","search_c":"'3.1.1':130C 'affect':118C 'ai':110C,124C 'allow':114C 'automat':109C,123C 'boost':107C,121C 'cross':97C 'cross-sit':96C 'generat':95C 'improp':88C 'input':91C 'issu':117C 'n/a':128C 'neutral':89C 'page':94C 'script':99C 'seo':108C,122C 'servic':104C 'site':98C 'store':115C 'translat':103C,105C,111C,119C,125C 'vulner':100C 'web':93C 'wplingua':102C,112C,113C,126C 'xss.this':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124410","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124410","severity":null,"published_at":"2026-11-13T15:17:36+00:00","modified_at":"2026-11-13T15:17:36+00:00","first_seen_at":"2026-11-13T15:46:16+00:00","fetched_at":"2026-11-13T15:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124410:3896","url":"https://rescuephp.com/news/wplingua-3-2-0-unauthenticated-stored-xss-forged-noise-placeholder","severity":null,"published_at":"2026-11-13T15:51:13+00:00","modified_at":"2026-11-13T15:51:13+00:00","first_seen_at":"2026-11-13T15:51:13+00:00","fetched_at":"2026-11-13T15:51:13+00:00","note":"NVD gives no fix. RescuePHP (secondary, citing WPSEC-2026-2763) says unauthenticated stored XSS via comments, fixed in 3.2.0 on 2026-11-09. WordPress.org API shows current 3.3.0. I could not read the vendor changelog, so nothing is marked verified. Its CVSS vector differs from NVD's (UI:N, 7.2 vs UI:R, 7.1). No exploitation or PoC found.","cites":["https://rescuephp.com/news/wplingua-3-2-0-unauthenticated-stored-xss-forged-noise-placeholder","https://wordpress.org/plugins/wplingua/"]}],"documents":[{"id":147282,"url":"https://rescuephp.com/news/wplingua-3-2-0-unauthenticated-stored-xss-forged-noise-placeholder","title":"wpLingua 3.2.0 Fixes Unauthenticated Stored XSS (RescuePHP)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":147283,"url":"https://wordpress.org/plugins/wplingua/","title":"wpLingua plugin page, WordPress.org","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}