WPML Multilingual CMS vulnerabilities

Latest WPML Multilingual CMS CVEs

Newest publication first

1. CVE-2026-76877 WPML Multilingual CMS <= 4.9.7 - Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' Parameter

   Published 2026-11-10

   High·CVSS 8.1 EPSS 0.40%

   The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the process_iframe_request function's language-per-domain SSO handler generating the cross-domain sign-in token via wp_...

2. CVE-2026-17509 WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’

   Published 2026-09-08

   Medium·CVSS 6.5 EPSS 0.40%

   The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL q...

3. CVE-2026-12248 WPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter

   Published 2026-08-15

   Medium·CVSS 6.5 EPSS 0.45%

   The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.