Stored Cross-Site Scripting in Falang Multilanguage Plugin for WordPress
CVE-2026-118047

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Falang Multilanguage For WordPress
Vendor
CVE Published:
7 November 2026

What is CVE-2026-118047?

The Falang multilanguage plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping in the 'falang_term[][][]' parameter. This flaw affects all versions up to and including 1.4.6, enabling authenticated users with subscriber-level access and above to execute arbitrary scripts on user pages. Attackers can exploit this vulnerability through the wp_update_term function, particularly as the required 'falang' nonce information becomes accessible to any logged-in user without adequate security measures in place.

Affected Version(s)

Falang multilanguage for WordPress 0 <= 1.4.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/falang/tags/1....
https://plugins.trac.wordpress.org/browser/falang/tags/1....

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hamachi_jp
.