CVE-2026-118047

Name of the Vulnerable Software and Affected Versions Falang multilanguage for WordPress versions prior to 1.4.7

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This is achieved via the falang term[<taxonomy>][<locale>][<field>] parameter, which influences wp update term() through order[]. Attackers can inject arbitrary web scripts into pages that execute when accessed by other users. The attack is facilitated by the wp ajax falang menu translation handler, which discloses the required falang nonce to any logged-in user.

Recommendations Update Falang multilanguage for WordPress to version 1.4.7 or later.