Vulnerability · Published Oct 21, 2026 · Assigned by WPScan

CVE-2026-105262Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

High 8.0

In plain English

A high-severity cross-site scripting in Falang multilanguage for WordPress from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Falang multilanguage for WordPress	0 – before 1.4.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/a7576e78-1fec-42fb-9c50-89b80e44fbc2/ exploit, vdb-entry, technical-description