CVE-2025-3488

Published: May 2, 2025Modified: May 6, 2025

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6.0 - 4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected (1)

Products: Wpml: Wpml

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wpml Wpml	From 3.6.0 to 4.7.4

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://wpml.org/category/changelog/

Source: security@wordfence.com

Release Notes

https://wpml.org/documentation/support/wpml-coding-api/shortcodes/

Source: security@wordfence.com

Product

https://www.wordfence.com/threat-intel/vulnerabilities/id/92c1bd85-5f81-4bb6-b6af-6cda85b91b9e?source=cve

Source: security@wordfence.com

Third Party Advisory

Timeline

No history available yet.