Vulnerability Description
WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilit
- https://wpml.org/changelog/2023/03/wpml-4-6-1-important-security-update/
- https://wpscan.com/vulnerability/b9cc519c-7ec2-42c3-9f42-01e928e12139/
- https://www.vulncheck.com/advisories/wpml-multilingual-cms-wordpress-plugin-4.6.
FAQ
What is CVE-2023-54413?
CVE-2023-54413 is a vulnerability with a CVSS score of 6.1 (MEDIUM). WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the...
How severe is CVE-2023-54413?
CVE-2023-54413 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-54413?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.