Wpml

This hub aggregates every CVE we track for Wpml, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Wpml.

• CVE-2025-3488WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode6.4May 2, 2025
• CVE-2024-6386WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection9.9Aug 21, 2024
• CVE-2022-38974WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability4.3Nov 18, 2022
• CVE-2022-38461WordPress WPML Multilingual CMS premium plugin <= 4.5.10 - Broken Access Control vulnerability5.4Nov 17, 2022
• CVE-2022-45071WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability5.4Nov 17, 2022
• CVE-2022-45072WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability4.3Nov 17, 2022
• CVE-2018-18069process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-loc...6.1Oct 8, 2018
• CVE-2015-2791The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/m...6.4Mar 30, 2015
• CVE-2015-2792The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request c...7.5Mar 30, 2015
• CVE-2015-2315Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup ac...4.3Mar 17, 2015
• CVE-2015-2314SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-aj...7.5Mar 17, 2015