WP Multilang EUVD-2026-60772

Exploitation requires that the target WordPress site has the WP Multilang plugin installed and active at version 2.4.31 or earlier. The CVSS vector PR:N confirms no authentication is required on the part of the attacker to craft and deliver the malicious URL. However, UI:R is a hard prerequisite - a victim user must actively follow the crafted link in a browser session; the vulnerability cannot be exploited passively or via server-side requests alone. The highest-impact exploitation path requires the victim to be a logged-in WordPress administrator at the time of interaction, enabling privilege abuse through the active admin session. Sites that have deactivated or uninstalled the WP Multilang plugin are not affected. No non-default plugin configuration or special server environment is indicated as a prerequisite - any default active installation of the affected version is exposed once a victim interacts with the crafted link.

The CVSS 7.1 High rating is justified primarily by the S:C (changed scope) metric, which elevates what might otherwise be a medium-severity reflected XSS into a higher tier due to cross-origin browser impact potential. The PR:N (no privileges required) and AC:L (low complexity) metrics confirm that crafting the exploit requires no account on the target system, lowering the barrier for opportunistic attackers. The mandatory UI:R (user interaction required) is the principal mitigating factor - exploitation depends on social engineering a victim into visiting a crafted URL, most critically a logged-in WordPress administrator. No EPSS data was included in the source intelligence, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed mass exploitation at time of analysis. That said, unauthenticated WordPress plugin XSS flaws with admin-targeting potential are routinely abused in bulk scanning campaigns, meaning even a mid-sized municipal IT team in bytom running multilingual WordPress deployments should treat this as a prompt patching priority rather than deferring to a routine maintenance cycle. The absence of an EPSS figure and unconfirmed POC status introduce uncertainty about near-term exploitation probability.

An attacker identifies a WordPress site running WP Multilang 2.4.31 or earlier, crafts a URL containing a JavaScript payload in the vulnerable parameter, and distributes the link via phishing email or social engineering targeting site administrators. When an authenticated administrator clicks the link, the injected script executes in their browser session, enabling session token exfiltration, rogue admin account creation, or silent plugin installation via the WordPress admin AJAX interface. No public exploit code has been confirmed in the provided intelligence, though reflected XSS of this type is trivially reproducible from advisory details.