CVE-2015-9416: Onthegosystems Sitepress-Multilingual-CMS

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.

Affected products

• Onthegosystems Sitepress-Multilingual-CMS: from 2.9.3, up to and including 3.2.6

Published 2019-09-26. Last modified 2026-06-17.