The WPML Multilingual CMS plugin for WordPress versions prior to 4.6.1 contains a reflected cross‑site scripting flaw. By supplying a crafted wp_lang parameter value in the /wp-login.php request, an unauthenticated attacker can inject arbitrary scripts that execute in the victim’s browser. This enables the attacker to steal session cookies, deface content, or redirect users to malicious sites.

Affected systems include the WPML Multilingual CMS plugin distributed by OnTheGoSystems. Any installation of the plugin with a version older than 4.6.1 is vulnerable, regardless of WordPress core version or site configuration.

The CVSS score of 5.1 indicates a medium‑severity vulnerability. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog. The attack vector is remote and relies on a malicious URL that redirects the user to /wp-login.php with a customized wp_lang parameter. Because the vulnerability is reflected, the attacker only needs to lure a victim to the crafted link; no further access or exploitation steps are required, making it readily exploitable by social engineering campaigns.