CVE-2026-124410: WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Q: Which versions are affected?

The issue affects wpLingua versions through 3.1.1. The provided data does not identify a fixed version.

Q: Can this be exploited remotely without an account?

The CVSS vector indicates network-based exploitation with low attack complexity and no privileges required, but user interaction is required. The vulnerability is stored XSS, so injected content may execute when another user views affected web content.

Q: Is a default installation known to be affected?

The available information identifies the affected plugin and version range, but does not state whether any particular default configuration or feature setting is required.

Published Nov 13, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO – Automatic AI translation – wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO – Automatic AI translation – wpLingua: from n/a through 3.1.1.

Affected Software

1 affected component

wordpress/wplingua<=3.1.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions are affected?

The issue affects wpLingua versions through 3.1.1. The provided data does not identify a fixed version.

Can this be exploited remotely without an account?

The CVSS vector indicates network-based exploitation with low attack complexity and no privileges required, but user interaction is required. The vulnerability is stored XSS, so injected content may execute when another user views affected web content.

Is a default installation known to be affected?

The available information identifies the affected plugin and version range, but does not state whether any particular default configuration or feature setting is required.

CVE-2026-124410: WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which versions are affected?

Can this be exploited remotely without an account?

Is a default installation known to be affected?

Company

Resources

Contact

Frequently Asked Questions

Which versions are affected?

Can this be exploited remotely without an account?

Is a default installation known to be affected?