Security Alert Summary
The WP Multilang – Translation and Multilingual Plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) flaw via post content in all versions up to and including 2.4.31. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary web scripts that execute whenever a user views an injected page.
CVE Details
- CVE ID: CVE-2026-15731
- Affected component: WP Multilang – Translation and Multilingual Plugin
- Affected versions: All versions up to and including 2.4.31
- Published: September 24, 2026 at 10:17:36 AM
- Last modified: September 24, 2026 at 2:40:36 PM
- CVSS v3.1: Base score 6.4, MEDIUM – Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction: Privileges Required: LOW (authenticated, Contributor-level or higher); User Interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue that exists because the plugin does not sufficiently sanitize input or escape output for post content. Authenticated users with Contributor-level access or higher can embed arbitrary web scripts in the content of pages or posts. When another user accesses a page containing the injected content, the malicious script executes in the context of the page.
The advisory does not name specific functions or REST endpoints involved; the root cause is described as insufficient input sanitization and output escaping of post content. Impact is limited to the ability to run arbitrary web scripts in affected pages and is bounded by the privileges of the viewing user and what data or actions are available to the page context.
How This Could Impact Your Website
Imagine a site where an external contractor or contributor creates or edits content, an internal editor reviews that content, and a site owner manages overall settings. If a contributor injects a script into a page, any staff member or visitor who views that page could unknowingly execute the script. Practical consequences include exposure of information visible to the page context, or unauthorized modification of content that the viewing user is permitted to perform.
Specific realistic risks include inadvertent exposure of internal user email addresses or other data available to the page, and an increased risk of targeted phishing or social engineering against staff who access infected pages. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior or unexpected content changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
