---
id: CVE-2023-54413
title: >-
  WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php
  wp_lang
summary: >-
  WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected
  cross-site scripting vulnerability that allows unauthenticated attackers to
  inject script by supplying crafted input in the wp_lang parameter. Attackers
  can lur…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: OnTheGoSystems
product: WPML Multilingual CMS
affected:
  - wpml_multilingual_cms < 4.6.1
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T10:57:35.997Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-54413'
references:
  - url: 'https://wpml.org/changelog/2023/03/wpml-4-6-1-important-security-update/'
    label: WPML 4.6.1 – Important Security Update
  - url: 'https://wpscan.com/vulnerability/b9cc519c-7ec2-42c3-9f42-01e928e12139/'
    label: WPScan Advisory
  - url: >-
      https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/wordpress/wpml-multilingual-cms-xss.yaml
    label: Nuclei Template
  - url: >-
      https://www.vulncheck.com/advisories/wpml-multilingual-cms-wordpress-plugin-4.6.1-reflected-xss-via-wp-login-php-wp-lang
    label: >-
      VulnCheck Advisory: WPML Multilingual CMS WordPress Plugin < 4.6.1
      Reflected XSS via wp-login.php wp_lang
tags:
  - cve.org
ingestedAt: '2026-10-22T11:37:02.339Z'
---

## Overview

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.

## Affected

- `wpml_multilingual_cms < 4.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.