Reflected XSS in WPML Multilingual CMS Plugin for WordPress (CVE-2023-54413)

What Happened

A reflected XSS vulnerability was identified in the WPML Multilingual CMS plugin for WordPress, affecting versions before 4.6.1. The vulnerability resides in how the plugin processes the wp_lang parameter. An attacker can craft a malicious link to /wp-login.php containing a specially constructed wp_lang value that injects an image input element with an obfuscated onfocus event handler. When a victim interacts with this element in their browser (such as by clicking the crafted link and triggering the handler), arbitrary JavaScript can execute in the context of the victim's session.

Technical Cause

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting). The root cause is insufficient sanitization of the wp_lang parameter before it is reflected back into the page output, allowing an attacker to inject HTML/JavaScript content that executes in the victim's browser when the crafted input is processed.

Why It Matters

This is a reflected XSS vulnerability exploitable without authentication, meaning an attacker does not need valid credentials to attempt exploitation. However, it does require user interaction — a victim must click or follow a crafted link and trigger the injected element. Because WPML is a popular plugin used on a large number of WordPress sites, the potential attack surface is broad. Successful exploitation could allow an attacker to execute scripts in a victim's browser session, which may lead to session manipulation or other client-side impacts, though the confidentiality and integrity impact is rated as low in the CVSS vector.

Discovery and Timeline

The fact package notes that exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12. No further details on discovery or disclosure timeline are available in the current records. The advisory itself was published on 2026-10-22.

Affected Versions

WPML (package name: sitepress-multilingual-cms) versions prior to 4.6.1 are affected by this vulnerability.

Fixes and Mitigation

The fact package indicates a fixed version boundary of 4.6.1 in the affected range data, but explicitly marks 'fix_available' as false and lists no confirmed fixed versions. This is a notable inconsistency in the source data: while 4.6.1 appears as the upper bound of the affected range, there is no confirmation that this version actually contains a fix or is currently available to users. We cannot confirm with certainty that updating resolves the issue based on the information provided.

Recommended Action

Site owners running WPML should monitor the plugin vendor's official channels for a confirmed security update, since the fix status could not be verified from the available records. In the meantime, administrators may consider restricting or monitoring access to wp-login.php and educating users against clicking untrusted or unexpected links, as this reduces the likelihood of successful exploitation given the required user interaction.