Falang Multilanguage For Wordpress
Monthly
Stored cross-site scripting in the Falang Multilanguage plugin for WordPress before 1.4.6 lets any authenticated user at Subscriber level or above plant script-bearing content that later renders in an administrator's browser session. The plugin's term-translation save handler performs no capability check and hands a valid nonce to any logged-in user, so a low-privilege account is enough to store the payload; execution still depends on a higher-privileged user opening the affected translation screen, which limits the real-world blast radius below the headline 8.0 score. Publicly available exploit code exists and the flaw is fixed in 1.4.6, but exploitation is only realistic on sites that allow self-registration or where the attacker already holds a low-tier account.
Stored cross-site scripting in the Falang Multilanguage plugin for WordPress before 1.4.6 lets any authenticated user at Subscriber level or above plant script-bearing content that later renders in an administrator's browser session. The plugin's term-translation save handler performs no capability check and hands a valid nonce to any logged-in user, so a low-privilege account is enough to store the payload; execution still depends on a higher-privileged user opening the affected translation screen, which limits the real-world blast radius below the headline 8.0 score. Publicly available exploit code exists and the flaw is fixed in 1.4.6, but exploitation is only realistic on sites that allow self-registration or where the attacker already holds a low-tier account.