The Falang multilanguage for WordPress plugin, when installed in versions prior to 1.4.6, lacks a capability check during the saving of term translations. An authenticated user with a Subscriber role or higher can trigger an unprotected endpoint that reveals a valid nonce. The attacker can then store malicious payloads that are rendered later without escaping. Although the attack requires user authentication, the stored script runs in the context of privileged users such as site administrators, enabling session hijacking, data theft, or further exploitation.

Affected systems include the Falang multilanguage for WordPress plugin for all installations of WordPress that use this plugin before version 1.4.6. The vulnerability is present in every instance that accepts term translations, and any site whose role hierarchy includes a Subscriber role or above is susceptible.

Risk assessment: The CVSS score is 8.0, marking this as high severity. The EPSS score is < 1%, suggesting that the probability of exploitation is low but not zero, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits yet. Nevertheless, because the flaw permits stored cross‑site scripting that propagates into administrator browsers, the potential impact is high. Attackers must be authenticated, but since Subscriber accounts are common, the barrier to exploitation is low. The absence of a known exploit does not reduce the urgency; the flaw remains suitable for use in targeted attacks.