polylang vulnerabilities
CVEs whose affected-version data names the polylang package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-97278High· 7.2Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
▾ TwilightWP SYNTEX · polylangEPSS 0.43%via NVD
CVE-2026-39783Medium· 4.3Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
▾ SunlitWP SYNTEX · polylangEPSS 0.16%via NVD
CVE-2026-97279Medium· 6.5Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
▾ SunlitChouby · polylangEPSS 0.15%via NVD