Polylang vulnerabilities
4 known CVE vulnerabilities in Polylang, translated and rated.
- CVE-2026-97278High
The Polylang plugin by WP SYNTEX up to version 3.8.9 contains an untrusted data deserialization vulnerability that allows Object Injection.
- CVE-2026-97279Medium
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
- CVE-2026-39783Medium
Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.
- CVE-2026-65458Medium
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS