CVE-2026-97278
CVE-2026-97278 · WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
CVSS 7.2 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
polylang
- Versions
- ≥ 0, ≤ 3.8.9: Affected; ≥ 3.8.10: Not affected (custom)
Update to 3.8.10