CVE-2026-15731 is a stored cross-site scripting vulnerability in the WP Multilang – Translation and Multilingual Plugin for WordPress. The issue arises from insufficient input sanitization and output escaping of post content, allowing authenticated users with Contributor-level access or above to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially compromising confidentiality and integrity. The vulnerability affects all versions up to and including 2.4.31.

The vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to partial confidentiality and integrity loss, such as session hijacking or unauthorized actions performed on behalf of users. Availability is not impacted. There are no known exploits in the wild at this time.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only and consider additional content filtering or monitoring to detect malicious script injections.