Known vulnerabilities in Falang multilanguage for WordPress

Falang is a WordPress multilingual plugin. Translate sites and WooCommerce content. Supports Google, Azure, DeepL and ChatGPT

9Reported vulnerabilities

8.8Highest CVSS score

1.4.4Latest version

1,000+Active installs

What to do now

Update Falang multilanguage for WordPress to 1.4.3 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 11, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2026-54805	High 8.8	0.4%	1.4.2 and earlier	`1.4.3`	June 16, 2026
CVE-2023-37968	High 8.8	0.2%	1.3.39 and earlier	`1.3.40`	July 17, 2023
CVE-2025-58619	High 8.1	0.4%	1.3.65 and earlier	`1.3.66`	September 16, 2025
CVE-2024-30495	High 7.2	0.6%	1.3.47 and earlier	`1.3.48`	March 28, 2024
CVE-2024-6869	High 7.1	0.3%	Before 1.3.53	`1.3.53`	August 8, 2024
WF-04917cfe-2bfb-48cf-a060-ca3bfde8eba1	Medium 6.1	—	Before 1.3.18	`1.3.18`	October 25, 2021
CVE-2024-4417	Medium 4.4	0.4%	1.3.49 and earlier	`1.3.50`	May 10, 2024
CVE-2025-48285	Medium 4.3	0.1%	1.3.61 and earlier	`1.3.62`	May 19, 2025
CVE-2024-37240	Medium 4.3	0.2%	1.3.51 and earlier	`1.3.52`	June 21, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.