PT-2025-44605 · Polylang · Polylang

Published 2025-10-31 · Updated 2025-10-31 · CVE-2025-64353

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chouby Polylang versions through 3.7.3

Description The Polylang software contains a flaw related to the deserialization of untrusted data, which can lead to object injection. This issue allows for potential malicious code execution through the processing of improperly serialized data.

Recommendations Update Polylang to a version newer than 3.7.3.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-64353

Affected Products

Polylang

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-64353 · Security Note
• https://twitter.com/CVEnew/status/1984236640253145384 · Twitter Post
• https://t.me/CVEtracker/36284 · Telegram Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/polylang/vulnerability/wordpress-polylang-plugin-3-7-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/polylang/vulnerability/wordpress-polylang-plugin-3-7-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/polylang/vulnerability/wordpress-polylang-plugin-3-7-3-deserialization-of-untrusted-data-vulnerability · Note