Answer in brief
CVE-2023-54413 records a Medium severity (CVSS 5.1) vulnerability in WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang. The current sources do not mark it as known exploited. The current feed maps OnTheGoSystems/WPML Multilingual CMS (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps OnTheGoSystems/WPML Multilingual CMS (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| OnTheGoSystems/WPML Multilingual CMSgeneric | >=0 <4.6.1 | 4.6.1 |
Published upstream
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 22, 2026
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
Quoted source text, attributed separately from HOL analysis.