Falang multilanguage for WordPress: Stored XSS via term translation
Summary
The Falang multilanguage plugin for WordPress before 1.4.6 does not check user capabilities when saving term translations. Users with Subscriber-level access or higher can store script content that is later output without proper escaping. The script runs in the browser of higher-privileged users such as administrators when they view the affected content.
Affected
- Falang multilanguage for WordPress versions before 1.4.6 (earliest vulnerable version unknown)
Fixed in
- Version 1.4.6
Workaround
- Unknown. No vendor-documented workaround found.
Exploitation
- No evidence of active exploitation found. Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no.
- No public proof of concept found; this does not prove none exists.
Our recommendation
- Inventory Falang installations and verify the plugin version.
- Update to Falang 1.4.6 or later, starting with sites that allow open registration.
- If patching is not immediately possible, restrict or disable open Subscriber registration.
- Review Subscriber accounts and recent changes to translation content for unexpected script code.
- Monitor the WPScan advisory and the plugin changelog.
- Note: CVSS scores differ between sources (NVD/CVSS 3.1 8.0 as provided; Vulners 5.9; VulDB 3.5). Plan according to the highest credible score.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory CVE-2026-105262 wpscan.com
- Falang plugin page (WordPress.org) wordpress.org
- VulDB 424582 vuldb.com
- OpenCVE CVE-2026-105262 app.opencve.io
- Vulners VulnRichment CVE-2026-105262 vulners.com
- Strix CVE-2026-105262 www.strix.ai
- WPScan Falang plugin vulnerabilities wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:14.
Original description (NVD)
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.