Security Alert Summary
The WPML Multilingual CMS plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in the wp_lang parameter on the login page. An unauthenticated attacker can craft a URL to /wp-login.php that injects an image input with an obfuscated onfocus handler to execute JavaScript in a victim’s browser when they visit the link.
CVE Details
- CVE ID: CVE-2023-54413
- Affected component: WPML Multilingual CMS plugin for WordPress
- Affected versions: versions before 4.6.1 (any version < 4.6.1)
- Published: October 22, 2026 at 11:17:05 AM UTC
- Last modified: October 22, 2026 at 11:17:05 AM UTC
- CVSS v3.1: Base Score 6.1 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Authentication required: none; Privileges required: none; User interaction: required
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This is a reflected cross-site scripting vulnerability in the WPML plugin caused by insufficient sanitization of the wp_lang parameter processed on the /wp-login.php page. An attacker can supply a crafted wp_lang value that injects an <input type=\"image\"> element with an obfuscated onfocus handler. When a target user is tricked into visiting the crafted login URL, the injected code executes in the context of the victim’s browser.
Exploitation evidence was observed by the Shadowserver Foundation on 2025-11-12, indicating active attempts to leverage this reflected XSS vector. The vulnerability arises from missing or inadequate output encoding and input validation for the wp_lang parameter on the login page.
How This Could Impact Your Website
In a realistic scenario, a site owner or administrator, an internal staff member with editor privileges, and an external contractor who logs in to the site could be targeted by a crafted link. If one of these users visits the malicious URL, JavaScript can run in their browser in the context of the login page. Practical consequences include exposure of data visible on that page, or actions performed within the page context that the script is permitted to do.
Specific practical risks include exposure of internal user information such as email addresses and an increased risk of targeted phishing or social engineering campaigns against your staff and contributors. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (install version 4.6.1 or later if applicable).
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that can interact with login or public pages.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected login attempts or suspicious URLs being accessed by users.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wpml-multilingual-cms-xss.yaml
- https://wpml.org/changelog/2023/03/wpml-4-6-1-important-security-update/
- https://wpscan.com/vulnerability/b9cc519c-7ec2-42c3-9f42-01e928e12139/
- https://www.vulncheck.com/advisories/wpml-multilingual-cms-wordpress-plugin-4.6.1-reflected-xss-via-wp-login-php-wp-lang
