Wpml
7 CVEs across 1 Wpml products. Browse Wpml vulnerabilities, severities, and proof-of-concept exploits.
Wpml products with known CVEs
Wpml CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-3488 | Medium | 6.4 | 2025-05-02 | The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6.0 - 4.7.3 due to i… |
CVE-2024-6386 | Critical | 9.9 | 2024-08-21 | The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This… |
CVE-2022-38974 | Medium | 4.3 | 2022-11-18 | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change… |
CVE-2022-45072 | Medium | 4.3 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-45071 | Medium | 5.4 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-38461 | Medium | 5.4 | 2022-11-17 | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change… |
CVE-2018-18069 | Medium | 6.1 | 2018-10-08 | process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_… |
CVE-2015-2792 | | | 2015-03-30 | The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and per… |
CVE-2015-2791 | | | 2015-03-30 | The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted reques… |
CVE-2015-2315 | | | 2015-03-17 | Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the t… |
CVE-2015-2314 | | | 2015-03-17 | SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in t… |