CVE-2026-97279
MediumCVSS 6.5Summary
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
Risk Assessment
A low-privileged user can execute malicious code in other users' browsers, potentially leading to session data theft or content modification.
Recommendation
Update the Polylang plugin to a version later than 3.8.9 to remove the XSS vulnerability.
Other vulnerabilities in Polylang
See all- CVE-2026-97278High
The Polylang plugin by WP SYNTEX up to version 3.8.9 contains an untrusted data deserialization vulnerability that allows Object Injection.
- CVE-2026-39783Medium
Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.
- CVE-2026-65458Medium
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS