CVE-2026-65458

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data.

This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-654597.5Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-654604.3Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.CVE-2026-654619.1Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.CVE-2026-654627.6Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.CVE-2026-654635.4Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.CVE-2026-654645.4Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.CVE-2026-654656.5Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.CVE-2026-654664.9Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.CVE-2026-654674.9Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.CVE-2026-654685.3Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.CVE-2026-654695.3Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.CVE-2026-654706.5Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
CVE-2026-65458: Medium severity, CVSS 4.3 | Vulnix