CVE-2026-97279: WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Polylang pluginto a version that resolves this vulnerability.Fixed in 3.8.10
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires an authenticated user with Contributor-level access. It is not described as exploitable by unauthenticated visitors.
Does exploitation require someone else to interact with attacker-controlled content?
Yes. The attack vector includes user interaction, so successful exploitation requires a victim to interact with the malicious content.
What is the potential impact of a successful exploit?
Successful cross-site scripting can affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the impact may extend beyond the vulnerable plugin's security authority.
Which installations should be considered affected?
WordPress sites using the Polylang plugin version 3.8.9 or earlier should be considered affected based on the supplied version range.