CVE-2026-105262
Deferred Deferred - Pending Action

Stored XSS in Falang WordPress Plugin via Unprotected Translation Handler

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-105262
EUVD
EUVD-2026-107052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Falang multilanguage for WordPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Falang multilanguage for WordPress plugin before version 1.4.6 has a vulnerability where it does not check user capabilities when saving term translations. This allows any logged-in user with Subscriber access or higher to inject malicious scripts through an unprotected handler that exposes a valid nonce. The injected scripts are stored and later executed without proper escaping, potentially affecting higher-privileged users like administrators.

Detection Guidance

Check the installed version of the Falang plugin in WordPress. If it is below 1.4.6, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

This vulnerability can allow attackers with basic user access to inject malicious scripts into the website. These scripts can then be executed by higher-privileged users such as administrators, potentially leading to unauthorized actions, data theft, or further compromise of the website. The impact includes potential loss of data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive user data to unauthorized parties through script injection. GDPR requires protection against unauthorized data processing, while HIPAA mandates safeguards for protected health information. A successful exploit may result in data breaches, violating these regulations.

Mitigation Strategies

Update the Falang plugin to version 1.4.6 or later immediately. Remove or disable the plugin if updating is not possible. Restrict user roles to the minimum required permissions to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...