CVE-2026-73342: WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability
Published Aug 18, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
Affected Software
1 affected component
WordPress WP Multilang plugin<=2.4.31
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Multilang Pluginto a version that resolves this vulnerability.Fixed in 2.4.32
Event History
Aug 18, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are identified as affected?
Sites using WP Multilang version 2.4.31 or earlier are identified as affected. The provided information does not state whether any particular WordPress configuration or plugin feature must be enabled.
2
What access does an attacker need to exploit this issue?
The vulnerability is described as unauthenticated, so an attacker does not need an account. Exploitation requires user interaction, as indicated by the UI:R vector.