CVE-2024-35644

The Preferred Languages plugin for WordPress through version 2.2.2 contains a stored cross-site scripting flaw in its administrative settings caused by inadequate sanitization of user input and insufficient escaping of output. An authenticated administrator can inject malicious scripts into the plugin settings, which will execute when other users view pages containing this injected content. This vulnerability is limited to multisite WordPress installations or those where the unfiltered_html capability has been restricted.

Based on public CVE data (MITRE/NVD).