Falang Multilanguage CVE-2026-105262

Exploitation requires an authenticated account at Subscriber level or above on the target WordPress site (PR:L), so the realistic precondition is a site that permits user registration (or an attacker who already holds any low-tier account). The attacker specifically leverages the plugin's unprotected term-translation save handler, which (a) performs no capability check and (b) leaks a valid nonce to any logged-in user, letting a low-privilege user store content. Triggering the payload requires a higher-privileged user (e.g., an administrator) to view the injected term translation (UI:R), so there is no zero-click impact. Limiting factors: closed-registration sites without low-privilege accounts, and the dependency on an admin actually opening the affected screen, both meaningfully reduce exploitability below the raw 8.0 score. Fixed in version 1.4.6.

This is a stored XSS (CWE-79) in the Falang multilanguage WordPress plugin before 1.4.6. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, score 8.0) indicates network-reachable, low-complexity exploitation requiring only low privileges (PR:L = Subscriber and above) plus user interaction (UI:R, a higher-privileged user must view the injected content). Publicly available exploit code exists (reported by WPScan), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation - exploitation status is 'publicly available exploit code exists,' not confirmed in-the-wild use. Two signals conflict with the headline severity: (1) the input vector rates C:H/I:H/A:H, which is aggressive for a stored XSS whose realistic worst case is admin-session hijack / account takeover rather than guaranteed full confidentiality-integrity-availability loss, and (2) scope is marked S:U despite the payload executing in a different user's (admin's) browser context, which normally justifies S:C. Net: a genuine, actionable medium-to-high priority for sites running this plugin that accept untrusted Subscriber registrations, but the 8.0 score likely overstates direct technical impact; prioritize patching where open user registration is enabled.

A site allows open registration, so an attacker signs up for a Subscriber account, then uses the exposed valid nonce and the unprotected term-translation save handler (which performs no capability check) to store a malicious XSS payload. When an administrator later views the affected term/translation screen in wp-admin, the unescaped payload executes in their authenticated session, enabling actions such as creating a rogue admin or planting a backdoor. A public exploit is available via WPScan, lowering the barrier to weaponization.