Woocommerce Multilingual Vulnerabilities

The WPML Multilingual & Multicurrency for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to injec...

CVSS:

6.4

Affected:

up to 5.5.6

Fixed in:

5.5.7

Disclosed:

Jul 31, 2026

CVE-2026-66711 on NVD →

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.3.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 5.3.8

Fixed in:

5.3.9

Disclosed:

Apr 9, 2025

CVE-2025-26888 on NVD →

[en] Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.8.

Affected:

up to 5.3.9

Fixed in:

5.3.9

Disclosed:

Apr 9, 2025

CVE-2025-26888 on NVD →

Affected:

up to 5.3.9

Fixed in:

5.3.9

Disclosed:

Apr 9, 2025

CVE-2025-26888 on NVD →

[en] Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency multilingual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.

Affected:

up to 5.3.7

Fixed in:

5.3.7

Disclosed:

Nov 1, 2024

CVE-2024-44006 on NVD →

[en] The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for unauthenticated attackers to inject arbitrary w...

Affected:

up to 5.3.8

Fixed in:

5.3.8

Disclosed:

Oct 8, 2024

CVE-2024-8629 on NVD →

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for unauthenticated attackers to inject arbitrary web sc...

CVSS:

6.1

Affected:

up to 5.3.7

Fixed in:

5.3.8

Disclosed:

Oct 7, 2024

CVE-2024-8629 on NVD →

Affected:

up to 5.3.8

Fixed in:

5.3.8

Disclosed:

Oct 7, 2024

CVE-2024-8629 on NVD →

The WooCommerce Multilingual & Multicurrency plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on a few functions like save_shipping_zone_method_from_ajax, switch_product_variations_language, and update_woocommerce_shipping_settings_for_class_costs_from_ajax in ve...

CVSS:

4.3

Affected:

up to 5.3.6

Fixed in:

5.3.7

Disclosed:

Sep 16, 2024

CVE-2024-44006 on NVD →

Affected:

up to 5.3.7

Fixed in:

5.3.7

Disclosed:

Sep 16, 2024

CVE-2024-44006 on NVD →

[en] Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.4.

Affected:

up to 5.3.5

Fixed in:

5.3.5

Disclosed:

Jun 9, 2024

CVE-2024-30466 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.3.1.

Affected:

up to 5.3.4

Fixed in:

5.3.4

Disclosed:

Apr 18, 2024

CVE-2024-32602 on NVD →

The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.3.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated att...

CVSS:

9.1

Affected:

up to 5.3.3.1

Fixed in:

5.3.4

Disclosed:

Apr 16, 2024

CVE-2024-32602 on NVD →

Affected:

up to 5.3.4

Fixed in:

5.3.4

Disclosed:

Apr 16, 2024

CVE-2024-32602 on NVD →

Affected:

up to 5.3.4

Fixed in:

5.3.4

Disclosed:

Apr 16, 2024

CVE-2024-32602 on NVD →

Affected:

up to 5.3.4

Fixed in:

5.3.4

Disclosed:

Apr 16, 2024

CVE-2024-32602 on NVD →

Affected:

up to 5.3.4

Fixed in:

5.3.4

Disclosed:

Apr 16, 2024

CVE-2024-32602 on NVD →

The WooCommerce Multilingual & Multicurrency plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 5.3.4

Fixed in:

5.3.5

Disclosed:

Mar 28, 2024

CVE-2024-30466 on NVD →

Affected:

up to 5.3.5

Fixed in:

5.3.5

Disclosed:

Mar 28, 2024

CVE-2024-30466 on NVD →