Log in Start free

WPML

Products

ProductCVEsExploitedLatest
WPML2–May 2, 2025
WPML Multilingual CMS2–Sep 8, 2026

Exploited and recent CVEs

  • CVE-2026-17509 Medium 6.5 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’ 0.4%
  • CVE-2026-12248 Medium 6.5 WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter 0.5%
  • CVE-2025-3488 Medium 6.4 WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode 0.3%
  • CVE-2024-6386 Critical 9.9 WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection 25.5%