121 matches found
EUVD-2026-118525
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Polylang: from n/a through 3.9...
CVE-2026-122670
The WordPress Polylang plugin (versions
WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Polylang versions = 3.9...
WordPress Polylang Pro plugin < 3.7.4 - Contributor+ PHP Object Injection vulnerability
Contributor+ PHP Object Injection vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Polylang Pro versions 3.7.4...
WordPress Polylang Pro plugin < 3.8.10 - Editor+ PHP Object Injection vulnerability
Editor+ PHP Object Injection vulnerability discovered by Ananda Dhakal in WordPress Plugin Polylang Pro versions 3.8.10...
WordPress Polylang Pro plugin < 3.8.6 - Contributor+ Private Post Disclosure via Row Update AJAX Actions vulnerability
Contributor+ Private Post Disclosure via Row Update AJAX Actions vulnerability discovered by Ananda Dhakal in WordPress Plugin Polylang Pro versions 3.8.6...
WordPress Polylang Pro plugin < 3.8.10 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Intrudify in WordPress Plugin Polylang Pro versions 3.8.10...
WordPress Polylang Pro plugin < 3.8.8 - Contributor+ Sensitive Information Exposure vulnerability
Contributor+ Sensitive Information Exposure vulnerability discovered by Ananda Dhakal in WordPress Plugin Polylang Pro versions 3.8.8...
CVE-2026-97278
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...
CVE-2026-97278 WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...
CVE-2026-97278 WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...
EUVD-2026-101009
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...
CVE-2026-97278
The WP SYNTEX Polylang plugin (versions up to and including 3.8.9 ) is vulnerable to a PHP Object Injection flaw caused by the deserialization of untrusted data in the polylang component. This vulnerability allows for high-impact consequences regarding confidentiality, integrity, and availability...
CVE-2026-101926
The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...
CVE-2026-101926 Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...
EUVD-2026-100812
The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...
CVE-2026-101926
The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.5.0 . The flaw exists in the woocommerce_remove_variations AJAX action due to insufficient escaping and lack of sufficient preparation on the user-supplied variation_id...
CVE-2026-101926 Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...
PT-2026-113637
Name of the Vulnerable Software and Affected Versions Hyyan WooCommerce Polylang Integration versions prior to 1.5.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform SQL Injection. This occurs via the variation ids parameter of the...