The WPML plugin for WordPress has a security vulnerability in versions up to and including 4.6.0 that could allow unauthenticated attackers to inject malicious web scripts into pages. This is because of insufficient input sanitization and output escaping of the wp_lang parameter. Attackers may be able to successfully trick a user into clicking on a link, which could cause the malicious web script to execute.