PLUGIN SECURITY
Is Sitepress Multilingual Cms safe?
Create the perfect solution that fits your exact translation & localisation needs. With our flexible tiers, you can build your own customised pric …
What this plugin does
- Slug:
sitepress-multilingual-cms - Author: EasyTranslate
- 20+ active installs
- 6661 all-time downloads
- On WordPress.org since 2020-06-16
easytranslatemultilingualtranslatetranslationwpml
Maintenance status
- Latest known version: 2.1.2
- Last updated: 2025-10-19 5:55pm GMT
- Tested up to WordPress: 6.8.8
Known vulnerabilities
14 known CVEs on file for Sitepress Multilingual Cms.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-12248 | WPML [sitepress-multilingual-cms] < 4.9.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 4.9.6 | 4.9.6 | 2026-08-14 | ⚠ update needed |
| CVE-2024-6386 | WPML [sitepress-multilingual-cms] < 4.6.13 | Improper Control of Generation of Code ('Code Injection') | High 8.8 | < 4.6.13 | 4.6.13 | 2024-08-21 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 3.1.7.2 | — | Unknown | < 3.1.7.2 | 3.1.7.2 | 2023-10-18 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 4.6.1 | — | Unknown | < 4.6.1 | 4.6.1 | 2023-04-16 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 4.6.1 | — | Unknown | < 4.6.1 | 4.6.1 | 2023-03-16 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 4.6.1 | — | Unknown | < 4.6.1 | 4.6.1 | 2023-03-16 | ⚠ update needed |
| CVE-2022-45071 | WPML [sitepress-multilingual-cms] < 4.5.14 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 4.5.14 | 4.5.14 | 2022-11-09 | ⚠ update needed |
| CVE-2022-38461 | WPML [sitepress-multilingual-cms] < 4.5.11 | — | Medium 5.4 | < 4.5.11 | 4.5.11 | 2022-11-09 | ⚠ update needed |
+ 16 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-38974 | WPML [sitepress-multilingual-cms] < 4.5.11 | — | Medium 4.3 | < 4.5.11 | 4.5.11 | 2022-11-09 | ⚠ update needed |
| CVE-2022-45072, CVE-2022-45071 | WPML [sitepress-multilingual-cms] < 4.5.14 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 4.5.14 | 4.5.14 | 2022-11-09 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 4.5.11 | — | Unknown | < 4.5.11 | 4.5.11 | 2022-09-26 | ⚠ update needed |
| CVE-2020-10568 | WPML [sitepress-multilingual-cms] < 4.3.8 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 4.3.8 | 4.3.8 | 2020-03-09 | ⚠ update needed |
| CVE-2018-18069 | WPML [sitepress-multilingual-cms] < 4.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.0 | 4.0 | 2018-10-08 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 3.1.7.2 | — | Unknown | < 3.1.7.2 | 3.1.7.2 | 2015-10-18 | ⚠ update needed |
| CVE-2015-9416 | WPML [sitepress-multilingual-cms] >= 2.9.3 - <= 3.2.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | 2.9.3–3.2.7 | 3.2.7 | 2015-09-02 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 3.2.7 | — | Unknown | < 3.2.7 | 3.2.7 | 2015-09-02 | ⚠ update needed |
| CVE-2015-2315 | WPML [sitepress-multilingual-cms] < 3.1.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 3.1.9 | 3.1.9 | 2015-03-11 | ⚠ update needed |
| CVE-2015-2791 | WPML [sitepress-multilingual-cms] < 3.1.9.1 | — | Unknown | < 3.1.9.1 | 3.1.9.1 | 2015-03-10 | ⚠ update needed |
| CVE-2015-2314, CVE-2015-2791, CVE-2015-2792 | WPML [sitepress-multilingual-cms] < 3.1.9.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 3.1.9.1 | 3.1.9.1 | 2015-03-10 | ⚠ update needed |
| CVE-2015-2792 | WPML [sitepress-multilingual-cms] < 3.1.9.1 | Improper Access Control | Unknown | < 3.1.9.1 | 3.1.9.1 | 2015-03-02 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] >= 3.6.0 - <= 4.7.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | 3.6.0–4.7.3 | 4.7.3 | 0000-00-00 | ⚠ update needed |
| — | WPML [sitepress-multilingual-cms] < 4.6.1 | — | Unknown | < 4.6.1 | 4.6.1 | — | ⚠ update needed |
| — | WPML Multilingual CMS < 4.6.1 - Reflected Cross-Site Scripting | — | Unknown | < 4.6.1 | 4.6.1 | — | ⚠ update needed |
| CVE-2025-3488 | WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode | — | Unknown | < 4.7.4 | 4.7.4 | — | ⚠ update needed |
How to fix it
Keep Sitepress Multilingual Cms updated — 2.1.2 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Loco Translate — 1000000+ active installs — 96/100 (452) — max PHP 8.4
- Translate WordPress with GTranslate — 900000+ active installs — 98/100 (4948) — max PHP 8.4
- Polylang — 800000+ active installs — 94/100 (2979) — max PHP 8.4
- TranslatePress – Translate Multilingual sites with AI Translation — 400000+ active installs — 94/100 (1653) — max PHP 8.4
- Cyr-To-Lat — 300000+ active installs — 94/100 (98)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.