EUVD-2026-60772
GHSA-mprq-p7v4-h684
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered reflected XSS with changed scope and no privileges; availability set to N as standard XSS does not disrupt service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
AnalysisAI
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the WP Multilang plugin installed and active at version 2.4.31 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 High rating is justified primarily by the S:C (changed scope) metric, which elevates what might otherwise be a medium-severity reflected XSS into a higher tier due to cross-origin browser impact potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running WP Multilang 2.4.31 or earlier, crafts a URL containing a JavaScript payload in the vulnerable parameter, and distributes the link via phishing email or social engineering targeting site administrators. When an authenticated administrator clicks the link, the injected script executes in their browser session, enabling session token exfiltration, rogue admin account creation, or silent plugin installation via the WordPress admin AJAX interface. … |
| Remediation | The primary remediation is to update WP Multilang to a version beyond 2.4.31 via the WordPress plugin dashboard or the WordPress.org plugin repository; patch available per vendor advisory, though the exact patched release version is not confirmed in the available source data - verify the current release at https://patchstack.com/database/wordpress/plugin/wp-multilang/vulnerability/wordpress-wp-multilang-plugin-2-4-31-cross-site-scripting-xss-vulnerability before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using WP Multilang plugin and identify those running versions 2.4.31 or earlier, then assess the criticality of each affected site. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today