WordPress plugin
Falang multilanguage for WordPress security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 11 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High3
- Medium8
- Low0
All Falang multilanguage for WordPress vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook ≤1.4.6Update to 1.4.7 | CVE-2026-118047 | |
| Medium6.4 | Authenticated (Subscriber+) Stored Cross-Site Scripting ≤1.4.5Update to 1.4.6 | CVE-2026-105262 | |
| High8.8 | Authenticated (Subscriber+) Privilege Escalation ≤1.4.2Update to 1.4.3 | CVE-2026-54805 | |
| High8.1 | Unauthenticated PHP Object Injection ≤1.3.65Update to 1.3.66 | CVE-2025-58619 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.3.61Update to 1.3.62 | CVE-2025-48285 | |
| Medium5.4 | Missing Authorization to Translation Update and Information Exposure ≤1.3.52Update to 1.3.53 | CVE-2024-6869 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.3.51Update to 1.3.52 | CVE-2024-37240 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤1.3.49Update to 1.3.50 | CVE-2024-4417 | |
| High7.2 | Authenticated (Administrator+) SQL Injection ≤1.3.47Update to 1.3.48 | CVE-2024-30495 | |
| Medium5.4 | Cross-Site Request Forgery via add_language ≤1.3.39Update to 1.3.40 | CVE-2023-37968 | |
| Medium6.1 | Reflected Cross-Site Scripting <1.3.18Update to 1.3.18 | — |
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook
≤1.4.6Update to 1.4.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤1.4.5Update to 1.4.6
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤1.4.2Update to 1.4.3
- High8.1Unauthenticated PHP Object Injection
≤1.3.65Update to 1.3.66
- Medium4.3Cross-Site Request Forgery
≤1.3.61Update to 1.3.62
- Medium5.4Missing Authorization to Translation Update and Information Exposure
≤1.3.52Update to 1.3.53
- Medium4.3Cross-Site Request Forgery
≤1.3.51Update to 1.3.52
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.3.49Update to 1.3.50
- High7.2Authenticated (Administrator+) SQL Injection
≤1.3.47Update to 1.3.48
- Medium5.4Cross-Site Request Forgery via add_language
≤1.3.39Update to 1.3.40
- Medium6.1Reflected Cross-Site Scripting
<1.3.18Update to 1.3.18
Falang multilanguage for WordPress: common questions
Does Falang multilanguage for WordPress have known vulnerabilities?
Yes. VulnCrest Radar lists 11 known vulnerabilities in Falang multilanguage for WordPress: 3 high, 8 medium. None are known to affect version null.
How do I check which version of Falang multilanguage for WordPress I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Falang multilanguage for WordPress vulnerability?
CVE-2026-118047, published Nov 6, 2026: Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook. Severity: Medium (CVSS 6.4).
Is any Falang multilanguage for WordPress vulnerability listed in CISA KEV?
No. None of the known Falang multilanguage for WordPress vulnerabilities is currently listed in the CISA KEV catalog.