{"id":"CVE-2023-54413","title":"WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang","summary":"WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lur…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"OnTheGoSystems","product":"WPML Multilingual CMS","affected":["wpml_multilingual_cms < 4.6.1"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T10:57:35.997Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-54413","references":[{"url":"https://wpml.org/changelog/2023/03/wpml-4-6-1-important-security-update/","label":"WPML 4.6.1 – Important Security Update"},{"url":"https://wpscan.com/vulnerability/b9cc519c-7ec2-42c3-9f42-01e928e12139/","label":"WPScan Advisory"},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wpml-multilingual-cms-xss.yaml","label":"Nuclei Template"},{"url":"https://www.vulncheck.com/advisories/wpml-multilingual-cms-wordpress-plugin-4.6.1-reflected-xss-via-wp-login-php-wp-lang","label":"VulnCheck Advisory: WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T11:37:02.339Z","slug":"CVE-2023-54413","body":"## Overview\n\nWPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.\n\n## Affected\n\n- `wpml_multilingual_cms < 4.6.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}