CyberSecBulletin

WPML vulnerabilities

We track 2 vulnerabilities in WPML products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.

2vulnerabilities
0critical
2high
0exploited
8.4average CVSS score

Latest WPML vulnerabilities

  • 8.1 High severity

    WPML Multilingual CMS: Improper Authentication

    CVE-2026-76877WPML

    The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up to, and including, 4.9.7. This is due to the `process_iframe_request` function's language-per-domain SSO handler generating the cross-domain

  • 8.8 High severity

    WPML: Improper Control of Generation of Code

    CVE-2024-6386WPMLEPSS 25.5%

    The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible f