CVE-2023-54413 WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang

Q: What is CVE-2023-54413?

CVE-2023-54413 is a medium-severity vulnerability in OnTheGoSystems WPML Multilingual CMS, published on 22 Oct 2026.

Q: Is CVE-2023-54413 being exploited?

There is no known exploitation of CVE-2023-54413 in the wild and no public exploit code.

Q: How do I fix CVE-2023-54413?

No fix has been published for CVE-2023-54413 yet. Limit exposure of the affected software until one is available.

Medium 5.1 Published 22 Oct 2026 Updated 22 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2023-54413?

CVE-2023-54413 is a medium-severity vulnerability in OnTheGoSystems WPML Multilingual CMS, published on 22 Oct 2026.

Official description

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.

Weakness: CWE-79

Which versions are affected by CVE-2023-54413?

How do I fix CVE-2023-54413?

No fix has been published for CVE-2023-54413 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-54413 being exploited?