VulnTitan VulnTitan Security command center
Vulnerability Report
Plugin Medium Patch path listed CVE-2015-9416

WPML 2.9.3-3.2.6 - Cross-Site Scripting in Accept-Language Header

The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.

Quick Answer

CVE-2015-9416 is a medium severity with CVSS 6.1 Cross-Site Scripting issue affecting the Plugin WPML. It affects 2.9.3 through 3.2.6 and is fixed in 3.2.7.

Back to Feed View Plugin Hub Open CVE Reference
Published
Sep 02, 2015
Last Updated
Jan 22, 2024
Slug
sitepress-multilingual-cms
Operational Summary

What the operator needs to know

Share Email
Patch Status
Patched release is available
Remediation
Update to version 3.2.7, or a newer patched version
Operator Briefing

CVE-2015-9416 is tracked for the Plugin WPML as medium severity with CVSS 6.1. The affected range is 2.9.3 through 3.2.6. Update WPML to 3.2.7 or newer where that version is compatible with the site.

Issue Type
Cross-Site Scripting
Primary Fixed Version
3.2.7
Primary Affected Range
2.9.3 through 3.2.6
Tracking ID
CVE-2015-9416
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/066b3b77-7888-4037-b443-a3c6fb540cf7?source=api-prod
Detailed Metadata
Software Type Plugin
Software Slug
sitepress-multilingual-cms View on wordpress.org
CVE CVE-2015-9416
Patched Versions
3.2.7
Affected Versions
2.9.3 through 3.2.6
Related CVE Cluster

Related CVEs for WPML

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Critical CVE-2024-6386 4.6.13 Aug 21, 2024
CVE-2024-6386 WPML Remote Code Execution

WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

Critical CVE-2015-2314 3.1.9.1 Mar 10, 2015
CVE-2015-2314 WPML SQL Injection

WPML <= 3.1.9 - SQL Injection via lang Parameter

High CVE-2020-10568 4.3.7 Mar 09, 2020
CVE-2020-10568 WPML Remote Code Execution

WPML < 4.3.7 - Cross-Site Request Forgery Bypass

High CVE-2015-2791 3.1.9.1 Mar 10, 2015
CVE-2015-2791 WPML Vulnerability

WPML <= 3.1.9 - Arbitrary Deletion of Content

High CVE-2018-18069 4.0 Oct 08, 2018
CVE-2018-18069 WPML Stored Cross-Site Scripting

WPML <= 3.6.3 - Unauthenticated Stored Cross-Site Scripting

Medium CVE-2025-3488 4.7.4 May 01, 2025
CVE-2025-3488 WPML Stored Cross-Site Scripting

WPML Multilingual CMS 3.6.0 - 4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode

Medium CVE-2015-2792 3.1.9.1 Mar 02, 2015
CVE-2015-2792 WPML Authorization Bypass

WPML < 3.1.8 - Authorization Bypass

Medium CVE-2022-45071 4.5.14 Nov 09, 2022
CVE-2022-45071 WPML Cross-Site Request Forgery

WPML <= 4.5.13 - Cross-Site Request Forgery

Licensing Notices

This record contains material that is subject to copyright

DEFIANT
Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more

MITRE
Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more