CVE-2018-18069: Improper Neutralization of Input During Web Page Generation

processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...

PT-2018-14332

Name of the Vulnerable Software and Affected Versions WPML plugin versions prior to 3.6.4 Description The issue concerns an XSS vulnerability. It can be exploited via any locale file name parameter, such as locale file name en, in an authenticated theme-localization.php request to...