CVE-2026-105262
CVE-2026-105262 · Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
CVSS 8.0 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
falang multilanguage for wordpress
- Versiones
- ≥ 0, < 1.4.6: Afectada (semver)
Actualiza a 1.4.6