WPML Multilingual CMS

WPML Multilingual CMS has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 16 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 9.9 out of 10. Severity breakdown: 2 critical and 3 high. 2022 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (25%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection.

Every one of the 16 issues recorded for WPML Multilingual CMS has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (4) reported by Dave Jong.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WPML Multilingual CMS vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.9CVE-2024-6386

WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

Read the full analysis

Vulnerability Records

16 records


2026-09-07 00:00	WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’ WPML Multilingual CMS <= 4.9.5	`CVE-2026-17509`	6.5 Medium	h0xilo	Yes
2026-08-14 00:00	WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter WPML Multilingual CMS <= 4.9.5	`CVE-2026-12248`	6.5 Medium	Yuto Hyakumoto	Yes
2025-05-01 17:11	WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode WPML Multilingual CMS 3.6.0 – 4.7.3	`CVE-2025-3488`	6.4 Medium	stealthcopter	Yes
2024-08-21 08:00	WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection WPML Multilingual CMS <= 4.6.12	`CVE-2024-6386`	9.9 Critical	stealthcopter	Yes
2023-04-16 00:00	WPML <= 4.6.0 - Reflected Cross-Site Scripting via wp_lang WPML Multilingual CMS <= 4.6.0	`N/A`	6.1 Medium	Deepak kumar	Yes
2022-11-09 00:00	WPML <= 4.5.10 - Missing Authorization to Translation Job Status Change WPML Multilingual CMS <= 4.5.10	`CVE-2022-38974`	4.3 Medium	Dave Jong	Yes
2022-11-09 00:00	WPML <= 4.5.13 - Cross-Site Request Forgery WPML Multilingual CMS <= 4.5.13	`CVE-2022-45071`	4.3 Medium	Dave Jong	Yes
2022-11-09 00:00	WPML <= 4.5.13 - Cross-Site Request Forgery WPML Multilingual CMS <= 4.5.13	`CVE-2022-45072`	4.3 Medium	Dave Jong	Yes
2022-11-09 00:00	WPML <= 4.5.10 - Missing Authorization to Settings Change WPML Multilingual CMS <= 4.5.10	`CVE-2022-38461`	4.3 Medium	Dave Jong	Yes
2022-09-26 00:00	WPML <= 4.5.10 - Unprotected AJAX Actions WPML Multilingual CMS <= 4.5.10	`N/A`	5.4 Medium	Anonymous	Yes

Showing 1–10 of 16 reports