OnTheGoSystems CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM OnTheGoSystems CVE published 2026-10-22

CVE-2023-54413

The WPML Multilingual CMS plugin for WordPress before version 4.6.1 contains a reflected cross-site scripting vulnerability. This vulnerability allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter of the wp-login.php file. The vulnerability can be exploited by luring users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onf [truncated]