WPML
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 2
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 09/13/2026, WPML recorded 2 security vulnerabilities in the last 90 days across 1 products, including 0 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, WPML Multilingual CMS had the most security vulnerabilities in the WPML ecosystem, with 2 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-17509WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’ | Exploitation statusNot known exploited | FixYes | Affected productWPML Multilingual CMS | Published09/08/2026 | SeverityMedium |
CVE-2026-12248WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter | Exploitation statusNot known exploited | FixYes | Affected productWPML Multilingual CMS | Published08/15/2026 | SeverityMedium |
CVE-2025-3488WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode | Exploitation statusNot known exploited | FixYes | Affected productWPML | Published05/02/2025 | SeverityMedium |
CVE-2024-6386WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection | Exploitation statusPublic exploit | FixYes | Affected productWPML | Published08/21/2024 | SeverityCritical |
CVE-2022-38974WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability | Exploitation statusNot known exploited | FixYes | Affected productWPML Multilingual CMS (WordPress plugin) | Published11/18/2022 | SeverityMedium |
CVE-2022-38461WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability | Exploitation statusNot known exploited | FixYes | Affected productWPML Multilingual CMS (WordPress plugin) | Published11/17/2022 | SeverityMedium |
CVE-2022-45071WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability | Exploitation statusNot known exploited | FixYes | Affected productWPML Multilingual CMS (WordPress plugin) | Published11/17/2022 | SeverityMedium |
CVE-2022-45072WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability | Exploitation statusNot known exploited | FixYes | Affected productWPML Multilingual CMS (WordPress plugin) | Published11/17/2022 | SeverityMedium |
CVE-2018-18069 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/08/2018 | SeverityUnknown |
CVE-2015-2792 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/30/2015 | SeverityUnknown |
CVE-2015-2791 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/30/2015 | SeverityUnknown |
CVE-2015-2314 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/17/2015 | SeverityUnknown |
CVE-2015-2315 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/17/2015 | SeverityUnknown |
.svg){kind=icon}