CVE-2023-54413: WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wplang parameter. Attackers can lure users to /wp-login.php with a wplang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An unauthenticated attacker can craft a link to wp-login.php with a malicious wp_lang parameter. The attacker must persuade a victim to open that link for the script to execute in the victim's browser.
Which installations are affected?
WPML Multilingual CMS versions earlier than 4.6.1 are affected. The supplied data does not identify any additional configuration prerequisite.
How can I check for suspected exploitation?
Review web-server and application logs for requests to /wp-login.php containing unusual or encoded wp_lang parameter values, particularly values that attempt to inject HTML elements or event handlers. Exploitation evidence was first observed on 2025-11-12.