WPML WPML Multilingual CMS

• CVE-2026-17509 Medium 6.5 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’ 0.4%
• CVE-2026-12248 Medium 6.5 WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter 0.5%