CVE-2026-105262: Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

Q: Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker can obtain a valid nonce through an unprotected handler and save malicious content in term translations.

Q: Who is affected when the stored payload executes?

The payload executes when it is later rendered for a higher-privileged user, such as an administrator. This can expose administrator sessions to cross-site scripting.

Q: Are versions before 1.4.6 affected?

Yes. The issue affects Falang multilanguage for WordPress versions earlier than 1.4.6.

Published Oct 21, 2026

Updated

The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.

Affected Software

1 affected component

Falang Falang multilanguage for WordPress<1.4.6

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker can obtain a valid nonce through an unprotected handler and save malicious content in term translations.

Who is affected when the stored payload executes?

The payload executes when it is later rendered for a higher-privileged user, such as an administrator. This can expose administrator sessions to cross-site scripting.

Are versions before 1.4.6 affected?

Yes. The issue affects Falang multilanguage for WordPress versions earlier than 1.4.6.

CVE-2026-105262: Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Who is affected when the stored payload executes?

Are versions before 1.4.6 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Who is affected when the stored payload executes?

Are versions before 1.4.6 affected?