Known vulnerabilities in Polylang

Go multilingual in a simple and efficient way. Keep writing posts and taxonomy terms as usual while defining their languages all at once.

4Reported vulnerabilities

8.8Highest CVSS score

3.8.7Latest version

800,000+Active installs

What to do now

Update Polylang to 3.8.6 or later. 4 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 17, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-d056eeea-6ed2-4139-ba32-727a95f29aaf	High 8.8	—	Before 2.5.1	`2.5.1`	January 16, 2019
CVE-2025-64353	High 7.5	0.3%	3.7.3 and earlier	`3.7.4`	October 28, 2025
CVE-2014-4855	Medium 4.3	1.6%	1.5.1 and earlier 1.5 to 1.5 (inclusive)	`1.5.2`	July 10, 2014
CVE-2026-65458	Medium 4.3	0.3%	3.8.5 and earlier	`3.8.6`	July 22, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.