CVE-2015-4338: Xcloner

Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days.

Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.

Affected products

• Xcloner Xcloner: version 3.1.2 only

Published 2015-06-17. Last modified 2026-06-17.