wpml

Security Risk Profile

/100

low

Security Risk Score

Comprehensive risk assessment based on 12 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 17, 2015 to present

Total CVEs

Critical+High

Exploited

Unpatched

Threat Assessment

Avg CVSS

6.5

Base severity

Avg EPSS

Exploit probability

Unpatched

Critical/High

Risk Level

38/100

low

🆕 1Fresh (<7d)📈 1 in Last 30 Days

Severity Distribution

Critical

High

Medium

Low

Exploit Likelihood

>50% chance

20-50%

5-20%

<5%

Age Distribution

Common Weaknesses (CWE)

XSS

SQL Injection

CSRF

Input Validation

Code Injection

Most Affected Products

1. WPML Wpml Wordpress11

2. WPML WPML Multilingual CMS for WordPress1

3. WPML WPML Multilingual CMS1

4. WordPress WPML plugin1

Recent Vulnerabilities

See more →

CVE-2026-12248

CVSS 6.5medium

WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter

8/15/2026🔧 No Patch

CVE-2025-3488

CVSS 6.4medium

WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode

5/2/2025🔧 No Patch

CVE-2024-6386

CVSS 9.9EPSS 0%critical

WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

8/21/2024🔧 No Patch

CVE-2022-38974

CVSS 4.3medium

WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

11/18/2022

CVE-2022-38461

CVSS 5.4medium

WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability

11/17/2022

CVE-2022-45071

CVSS 8.8high

WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

11/17/2022🔧 No Patch

CVE-2022-45072

CVSS 4.3medium

WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability