Wp Multilang
Monthly
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.