The Falang multilanguage for WordPress plugin suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Authenticated users with administrator privileges can inject arbitrary scripts via admin settings. These scripts execute in the context of users visiting the affected pages. The vulnerability affects multi-site setups and installations where unfiltered_html is disabled. No official patch or fix information is provided in the available data.

An attacker with administrator-level access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability is limited to multi-site WordPress installations with unfiltered_html disabled and requires high privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling or limiting use of the Falang multilanguage plugin in multi-site environments. Monitor official vendor channels for updates or patches addressing this vulnerability.