Matt Rusnak

**Name of the Vulnerable Software and Affected Versions** WordPress Core versions up to, and including, 6.2 **Description** The issue allows unauthenticated attackers to access and load arbitrary translation files via the `wp lang` parameter, potentially leading to a Cross-Site Scripting attack if a crafted translation file is uploaded to the site. **Recommendations** For WordPress Core versions up to, and including, 6.2, consider restricting access to the `wp lang` parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using upload forms that could allow attackers to upload crafted translation files.