tadrik Free store check

Plugin security / WPML Multilingual & Multicurrency for WooCommerce

WPML Multilingual & Multicurrency for WooCommerce vulnerability: is your WooCommerce store affected?

WPML Multilingual & Multicurrency for WooCommerce has one serious security hole rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 9 April 2025. Every one is fixed: update to 5.5.8 or newer.

Short answer: your store is affected if it runs WPML Multilingual & Multicurrency for WooCommerce older than 5.5.8. Update to 5.5.8 or newer, on a copy of the store first if you can.

In our check of 3,600 live UK and US WooCommerce stores (31 October 2026 to 1 November 2026), 8 were running a version of WPML Multilingual & Multicurrency for WooCommerce with a serious hole that already had a fix. How we checked.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 5.5.8Fixed in 5.5.8Published 9 April 2025CVE-2026-66711

    Advisory: Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find WPML Multilingual & Multicurrency for WooCommerce. The version number is under its name. If it is lower than 5.5.8, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/woocommerce-multilingual/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update WPML Multilingual & Multicurrency for WooCommerce to 5.5.8 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use WPML Multilingual & Multicurrency for WooCommerce.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use WPML Multilingual & Multicurrency for WooCommerce, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which WPML Multilingual & Multicurrency for WooCommerce version fixes it?
Version 5.5.8 or newer fixes the issue on this page.
How do I know if my store is affected?
Your store is affected if it runs WPML Multilingual & Multicurrency for WooCommerce older than 5.5.8. In WordPress, open Plugins and read the version under WPML Multilingual & Multicurrency for WooCommerce. Without logging in, open yourstore.com/wp-content/plugins/woocommerce-multilingual/readme.txt and read the Stable tag line.
I don't use WPML Multilingual & Multicurrency for WooCommerce any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.