WPML vulnerabilities
5 published CVEs name WPML among the affected products.
- 5Published CVEs5 of them scored
- 3Last 12 monthspublished in the last year
- 1Critical1 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-76877
WPML Multilingual CMS <= 4.9.7 - Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter
WPML · WPML Multilingual CMS
High8.1 - CVE-2026-17509
WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
WPML · WPML Multilingual CMS
Medium6.5 - CVE-2026-12248
WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter
WPML · WPML Multilingual CMS
Medium6.5 - CVE-2025-3488
WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode
WPML · WPML
Medium6.4 - CVE-2024-6386
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
WPML · WPML
Critical9.9