Stored Cross-Site Scripting in User Language Switch Plugin by WordPress

CVE-2026-0735

What is CVE-2026-0735?

The User Language Switch plugin for WordPress has a vulnerability that allows authenticated attackers with administrator-level access to perform Stored Cross-Site Scripting. This weakness arises through the 'tab_color_picker_language_switch' parameter, where insufficient input sanitization and output escaping can be exploited. Attackers can inject arbitrary web scripts into pages, and these scripts will execute when an unsuspecting user accesses an affected page. This issue primarily impacts multi-site installations and those with 'unfiltered_html' disabled, presenting a significant risk to user security.

References