The Falang multilanguage plugin for WordPress is vulnerable to a stored cross‑site scripting flaw that occurs when the plugin accepts input for the falang_term parameter without proper sanitization or escaping before it is stored and later rendered. An attacker who can log into the site with subscriber‑level or higher privileges can inject arbitrary JavaScript into these parameters. The injected script is persisted in the database and will execute for any user who views the affected page, enabling session hijacking, defacement, or data theft. The weakness corresponds to a classic input‑validation XSS flaw (CWE‑79). The exploit requires only an authenticated user, and the required nonce is publicly visible to any logged‑in user, making the attack trivial for any identity that can log in.

The vulnerability affects all installations of the Falang multilanguage plugin with version 1.4.6 or earlier. The affected component is the Falang plugin for WordPress, coded by sbouey. Administrators should identify sites running this plugin and verify the installed version.

The CVSS base score for this flaw is 6.4, indicating moderate‑to‑high severity. The EPSS score is not reported, so the current exploitation probability is unknown but the vulnerability can be easily discovered by anyone logged in. In addition, the flaw is not listed in the CISA KEV catalog, meaning there is no publicly known exploited proof‑of‑concept code in circulation. The hook revealing the form nonce is unprotected, so an attacker can obtain it through a normal authenticated request, reducing the effort needed. Because the attack requires only a subscriber account, the potential for widespread compromise is significant, especially on sites with many active users.