WP Multilang EUVD-2026-85837

Exploitation requires an authenticated account with Contributor-level capabilities or above on the target WordPress site running WP Multilang <=2.4.31, allowing the attacker to create/edit post content. The payload is stored in post content and triggers automatically (UI:N for the attacker) when any user, including higher-privileged administrators, accesses the injected page - no separate victim click on a crafted link is needed. What limits exploitation: sites that do not permit untrusted user registration at Contributor level or higher, and sites already updated past 2.4.31, are not exposed; the impact is bounded to browser-context script execution (C:L/I:L) rather than direct server compromise.

This is a moderate-severity stored XSS (CWE-79) with a Wordfence-assigned CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The network vector and low attack complexity are offset by the PR:L requirement: the attacker must already hold Contributor-level access or above, so this is not an unauthenticated internet-wide risk but rather a privilege-abuse/insider or compromised-low-privilege-account scenario. The scope change (S:C) correctly reflects that injected script executes in the browser context of any user viewing the page, including higher-privileged editors/admins, which is the real escalation path. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals in the data - CVSS vector, description, and CWE are internally consistent. Net priority: a genuine but not urgent issue; patch on a normal cycle, prioritizing sites that allow untrusted Contributor/Author registrations.

An attacker who has registered or obtained a Contributor-level account crafts a post whose content contains a malicious script payload that survives the plugin's insufficient sanitization. When an administrator or other user previews or views the resulting page, the script executes in their authenticated session, enabling session/nonce theft or admin actions. No public proof-of-concept was identified, and exploitation requires the attacker to already hold an authenticated low-privilege account.