--- id: "CVE-2026-124410" page: "https://infrastack.ai/live/CVE-2026-124410" kind: "vulnerability" aliases: ["CVE-2026-124410"] title: "wpLingua WordPress plugin up to 3.1.1: unauthenticated stored XSS through comments" severity: "high" cvss: 7.1 epss: null exploited: false status: "open" category: "other" products: [{"name": "wplingua", "fixed": ["3.2.0"], "affected": "<= 3.1.1", "ecosystem": "wordpress"}] ecosystems: [] tags: ["comments", "other", "stored-xss", "unauthenticated", "wordpress", "wplingua", "xss"] not_affected_if: ["comments-disabled", "plugin-not-installed"] published_at: "2026-11-13T15:17:36+00:00" first_seen_at: "2026-11-13T15:46:16+00:00" updated_at: "2026-11-13T15:51:13+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124410", "first_seen_at": "2026-11-13T15:46:16+00:00"}, {"source": "analyst", "url": "https://rescuephp.com/news/wplingua-3-2-0-unauthenticated-stored-xss-forged-noise-placeholder", "first_seen_at": "2026-11-13T15:51:13+00:00", "cites": ["https://rescuephp.com/news/wplingua-3-2-0-unauthenticated-stored-xss-forged-noise-placeholder", "https://wordpress.org/plugins/wplingua/"]}] exploit_sources: [] --- # wpLingua WordPress plugin up to 3.1.1: unauthenticated stored XSS through comments Link for people: https://infrastack.ai/live/CVE-2026-124410 (this .md is for agents) wpLingua (Translate and boost SEO - Automatic AI translation) up to and including 3.1.1 has a stored XSS flaw. According to a secondary write-up of WPSEC-2026-2763, an anonymous commenter can forge the parser's ___noise___ placeholder keys inside a comment attribute. The injected markup then runs for visitors of the translated page, administrators included. No exploitation reported. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - wordpress:wplingua affected <= 3.1.1 fixed 3.2.0 ## How to check In WP admin > Plugins, check whether wpLingua is installed and its version is 3.1.1 or lower (WP-CLI: wp plugin get wplingua --field=version). Sites with comments open on translated pages are the main exposure. Search comments for the string ___noise___. ## Fix Update wpLingua to 3.2.0 or later (3.3.0 is current on WordPress.org). 3.2.0 as the fix version comes from a secondary source, RescuePHP. If you can't update, close comments or hold them for moderation. ## Timeline - 2026-11-13T15:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124410 - 2026-11-13T15:51:13+00:00 analyst https://rescuephp.com/news/wplingua-3-2-0-unauthenticated-stored-xss-forged-noise-placeholder — NVD gives no fix. RescuePHP (secondary, citing WPSEC-2026-2763) says unauthenticated stored XSS via comments, fixed in 3.2.0 on 2026-11-09. WordPress.org API shows current 3.3.0. I could not read the vendor changelog, so nothing is marked verified. Its CVSS vector differs from NVD's (UI:N, 7.2 vs UI:R, 7.1). No exploitation or PoC found. ## Documents - [describes] wpLingua 3.2.0 Fixes Unauthenticated Stored XSS (RescuePHP) https://rescuephp.com/news/wplingua-3-2-0-unauthenticated-stored-xss-forged-noise-placeholder - [mentions] wpLingua plugin page, WordPress.org https://wordpress.org/plugins/wplingua/ ## From the sources Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO – Automatic AI translation – wpLingua: from n/a through 3.1.1. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_