WPML

Vulnerabilities 21Slug sitepress-multilingual-cmsPlugin page →

Minimum safe version

4.6.13

Update to 4.6.13 or later to address 19 fixable vulnerabilities

Affected up to4.7.3 ⚠
Medium 6.4
2025-05-02≥ 3.6.0 and ≤ 4.7.3

WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode

EUVDWordfencePatchstackCVE
N/A
< 4.6.1

WPML Multilingual CMS &lt; 4.6.1 - Reflected Cross-Site Scripting

WPScan
N/A
2023-10-18< 3.1.7.2

WordPress Multilingual CMS Plugin <= 3.1.7.1 is vulnerable to Full Path Disclosure (FPD)

Patchstack
N/A
2023-03-16< 4.6.1

WPML <= 4.6.1 - Cross-Site Scripting

Wordfence
N/A
2023-04-16< 4.6.1

WPML <= 4.6.0 - Reflected Cross-Site Scripting via wp_lang

Wordfence
N/A
2023-03-16< 4.6.1

WordPress WPML - WordPress Multilingual Plugin < 4.6.1 is vulnerable to Cross Site Scripting (XSS)

Patchstack
N/A
2022-09-26< 4.5.11

WPML <= 4.5.10 - Unprotected AJAX Actions

Wordfence
N/A
2015-09-02< 3.2.7

WordPress WPML Plugin <= 3.2.6 - Cross Site Scripting

Patchstack
N/A
2015-10-18< 3.1.7.2

WordPress Multilingual CMS Plugin <= 3.1.7.1 - Full Path Disclosure

Patchstack