CVE-2026-105262: CWE-79 Cross-Site Scripting (XSS) in Falang multilanguage for WordPress

The Falang multilanguage for WordPress plugin prior to version 1.4.6 does not verify user capabilities when saving term translations and exposes a valid nonce through an unprotected handler accessible to any logged-in user. This flaw enables users with Subscriber-level access or higher to store malicious content that is later rendered without proper escaping, resulting in stored Cross-Site Scripting (CWE-79) that can execute in the security context of higher-privileged users such as administrators.

An attacker with Subscriber-level access or above can inject malicious scripts that execute in the browser context of higher-privileged users, including administrators. This can lead to session hijacking, privilege escalation, or other attacks leveraging the administrator's privileges within the WordPress environment.

Upgrade the Falang multilanguage for WordPress plugin to version 1.4.6 or later, where this vulnerability is fixed. Since no official patch link is provided, users should verify the availability of the update from the plugin's official source and apply it promptly. Until patched, restrict user roles to trusted users only and monitor for suspicious activity related to term translations.