xili-language Security & Risk Analysis

wordpress.org/plugins/xili-language

xili-language lets you create and manage multilingual WP site in several languages with yours or most famous localizable themes. Ready for CMS design.

700 active installs v2.21.3 PHP 7.4.2+ WP 4.3.5+ Updated Apr 2, 2025
mo-filelanguagelocalizationmultilingualtaxonomy
69
C · Use Caution
CVEs total2
Unpatched1
Last CVESep 22, 2025
Safety Verdict

Is xili-language Safe to Use in 2026?

Use With Caution

Score 69/100

xili-language has 1 unpatched vulnerability. Evaluate alternatives or apply available mitigations.

2 known CVEs 1 unpatched Last CVE: Sep 22, 2025Updated 1yr ago
Risk Assessment

The xili-language plugin v2.21.3 exhibits a mixed security posture. While it demonstrates some good practices, such as a high percentage of prepared SQL statements and a decent number of nonce and capability checks, several significant concerns warrant attention. The presence of a dangerous `unserialize` function, coupled with multiple flows containing unsanitized paths, including two of high severity, indicates potential vulnerabilities for remote code execution or data manipulation.

Furthermore, the plugin has a history of known vulnerabilities, with one currently unpatched medium severity CVE. The common vulnerability type being Cross-site Scripting also suggests that input sanitization and output escaping are areas that require more robust implementation. The unprotected AJAX handler is a direct attack vector that, if combined with other weaknesses, could be exploited.

In conclusion, while the plugin is not riddled with critical flaws based on the static analysis, the combination of high-severity taint flows, an unpatched CVE, and an unprotected AJAX endpoint presents a tangible risk. The plugin's security would be significantly improved by addressing these specific issues and potentially increasing the diligence in output escaping.

Key Concerns

  • Unprotected AJAX handler
  • High severity taint flows
  • Dangerous function: unserialize
  • Unpatched CVE
  • Low output escaping percentage
  • Flows with unsanitized paths
Vulnerabilities
2

xili-language Security Vulnerabilities

CVEs by Year

2 CVEs in 2025 · unpatched
2025
Patched Has unpatched

Severity Breakdown

Medium
2

2 total CVEs

CVE-2025-58654medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

xili-language <= 2.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

Sep 22, 2025Unpatched
CVE-2025-31085medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

xili-language <= 2.21.2 - Reflected Cross-Site Scripting

Apr 1, 2025 Patched in 2.21.3 (9d)
Code Analysis
Analyzed Mar 16, 2026

xili-language Code Analysis

Dangerous Functions
3
Raw SQL Queries
5
23 prepared
Unescaped Output
411
123 escaped
Nonce Checks
19
Capability Checks
12
File Operations
5
External Requests
9
Bundled Libraries
0

Dangerous Functions Found

unserialize$pll_description = unserialize( $language->description );xili-includes\pll_functions.php:21
unserialize$array_groups[] = unserialize ( $pll_one_post_group->description );xili-includes\pll_functions.php:110
unserialize$pll_links = unserialize( $term->description );xili-includes\pll_functions.php:202

SQL Query Safety

82% prepared28 total queries

Output Escaping

23% escaped534 total outputs
Data Flows
4 unsanitized

Data Flow Analysis

6 flows4 with unsanitized paths
post_translation_display (xili-includes\xl-class-admin.php:4742)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

xili-language Attack Surface

Entry Points7
Unprotected1

AJAX Handlers 3

authwp_ajax_find_post_typesxili-includes\xl-class-admin.php:207
authwp_ajax_save_bulk_editxili-includes\xl-class-admin.php:271
authwp_ajax_get_menu_infosxili-includes\xl-class-admin.php:273

Shortcodes 4

[xili18n] xili-language.php:602
[xili-show-if] xili-language.php:604
[linked-post-in] xili-language.php:606
[xili-flag] xili-language.php:609
WordPress Hooks 250
filterclean_previous_languages_listxili-includes\pll_functions.php:54
filterrecreate_links_from_previousxili-includes\pll_functions.php:163
filterprevious_install_list_messagesxili-includes\pll_functions.php:185
actionimport_list_forms_actionxili-includes\pll_functions.php:416
filterimport_list_of_actionsxili-includes\pll_functions.php:463
actioncustomize_registerxili-includes\theme-multilingual-classes.php:54
actionwp_headxili-includes\theme-multilingual-classes.php:57
actioninitxili-includes\theme-multilingual-classes.php:59
filterwp_nav_menu_argsxili-includes\theme-multilingual-classes.php:60
actioninitxili-includes\theme-multilingual-classes.php:63
actionadmin_menuxili-includes\theme-multilingual-classes.php:391
actionadmin_initxili-includes\theme-multilingual-classes.php:393
actionadmin_print_stylesxili-includes\theme-multilingual-classes.php:395
actionadmin_print_scriptsxili-includes\theme-multilingual-classes.php:397
actionsave_postxili-includes\xili-language-widgets.php:75
actiondeleted_postxili-includes\xili-language-widgets.php:76
actionswitch_themexili-includes\xili-language-widgets.php:77
actionwp_headxili-includes\xili-language-widgets.php:257
actioncomment_postxili-includes\xili-language-widgets.php:259
actionedit_commentxili-includes\xili-language-widgets.php:260
actiontransition_comment_statusxili-includes\xili-language-widgets.php:261
filtercomments_clausesxili-includes\xili-language-widgets.php:311
actionwp_headxili-includes\xili-language-widgets.php:594
actionxili_language_widgets_list_headxili-includes\xili-language-widgets.php:624
actionset_object_termsxili-includes\xili-language-widgets.php:863
filterredirect_canonicalxili-includes\xili-permalinks-class.php:50
actionpre_option_rewrite_rulesxili-includes\xili-permalinks-class.php:52
filterhome_urlxili-includes\xili-permalinks-class.php:57
filterpre_post_linkxili-includes\xili-permalinks-class.php:58
filterpost_linkxili-includes\xili-permalinks-class.php:61
filterget_shortlinkxili-includes\xili-permalinks-class.php:62
filterpost_type_linkxili-includes\xili-permalinks-class.php:63
filter_get_page_linkxili-includes\xili-permalinks-class.php:64
filteryear_linkxili-includes\xili-permalinks-class.php:66
filtermonth_linkxili-includes\xili-permalinks-class.php:67
filterday_linkxili-includes\xili-permalinks-class.php:68
filterauthor_linkxili-includes\xili-permalinks-class.php:70
filterterm_linkxili-includes\xili-permalinks-class.php:72
filterterm_linkxili-includes\xili-permalinks-class.php:75
filtersearch_feed_linkxili-includes\xili-permalinks-class.php:78
filterpost_type_archive_feed_linkxili-includes\xili-permalinks-class.php:79
filterget_pagenum_linkxili-includes\xili-permalinks-class.php:82
filterhome_urlxili-includes\xili-permalinks-class.php:120
filterrewrite_rules_arrayxili-includes\xili-permalinks-class.php:193
actionadmin_initxili-includes\xl-class-admin.php:149
actionadmin_headxili-includes\xl-class-admin.php:151
filterwp_get_nav_menusxili-includes\xl-class-admin.php:152
actionadmin_bar_initxili-includes\xl-class-admin.php:155
filterlocalexili-includes\xl-class-admin.php:158
actionadmin_initxili-includes\xl-class-admin.php:160
actionpersonal_options_updatexili-includes\xl-class-admin.php:161
actionpersonal_optionsxili-includes\xl-class-admin.php:162
actionedit_user_profile_updatexili-includes\xl-class-admin.php:163
filterplugin_row_metaxili-includes\xl-class-admin.php:166
filterplugin_action_linksxili-includes\xl-class-admin.php:167
actionafter_plugin_rowxili-includes\xl-class-admin.php:168
actionadmin_menuxili-includes\xl-class-admin.php:173
actionadmin_menuxili-includes\xl-class-admin.php:174
filteradmin_titlexili-includes\xl-class-admin.php:176
actionadmin_print_styles-settings_page_language_pagexili-includes\xl-class-admin.php:178
actionadmin_print_styles-settings_page_language_front_setxili-includes\xl-class-admin.php:179
actionadmin_print_styles-settings_page_language_expertxili-includes\xl-class-admin.php:180
actionadmin_print_styles-settings_page_author_rulesxili-includes\xl-class-admin.php:181
actionadmin_print_styles-settings_page_language_filesxili-includes\xl-class-admin.php:182
actionadmin_print_styles-settings_page_language_supportxili-includes\xl-class-admin.php:183
actionadmin_initxili-includes\xl-class-admin.php:186
actionadmin_initxili-includes\xl-class-admin.php:187
actionadmin_initxili-includes\xl-class-admin.php:188
actionadmin_initxili-includes\xl-class-admin.php:191
actionpost_submitbox_startxili-includes\xl-class-admin.php:192
actionadmin_initxili-includes\xl-class-admin.php:195
actionadmin_initxili-includes\xl-class-admin.php:196
actionadmin_initxili-includes\xl-class-admin.php:199
actionadmin_menuxili-includes\xl-class-admin.php:201
actionadmin_print_scripts-post.phpxili-includes\xl-class-admin.php:203
actionadmin_print_scripts-post-new.phpxili-includes\xl-class-admin.php:204
actionadmin_print_styles-post.phpxili-includes\xl-class-admin.php:209
actionadmin_print_styles-post-new.phpxili-includes\xl-class-admin.php:210
actionsave_postxili-includes\xl-class-admin.php:216
actionsave_postxili-includes\xl-class-admin.php:217
filterattachment_fields_to_editxili-includes\xl-class-admin.php:220
filterattachment_fields_to_savexili-includes\xl-class-admin.php:221
actiondelete_attachmentxili-includes\xl-class-admin.php:222
filterwp_delete_filexili-includes\xl-class-admin.php:223
actionattachment_submitbox_misc_actionsxili-includes\xl-class-admin.php:225
filterdisplay_media_statesxili-includes\xl-class-admin.php:226
actionedit_attachmentxili-includes\xl-class-admin.php:227
actionadd_attachmentxili-includes\xl-class-admin.php:228
actionedit_attachmentxili-includes\xl-class-admin.php:229
actiondelete_attachmentxili-includes\xl-class-admin.php:230
actionadmin_menuxili-includes\xl-class-admin.php:231
actionadmin_menuxili-includes\xl-class-admin.php:233
actionadmin_initxili-includes\xl-class-admin.php:234
filtermanage_edit-post_columnsxili-includes\xl-class-admin.php:237
filtermanage_post_posts_columnsxili-includes\xl-class-admin.php:238
filtermanage_page_posts_columnsxili-includes\xl-class-admin.php:239
filtermanage_media_columnsxili-includes\xl-class-admin.php:240
filterbbp_admin_forums_column_headersxili-includes\xl-class-admin.php:252
filterbbp_admin_topics_column_headersxili-includes\xl-class-admin.php:253
filterbbp_admin_replies_column_headersxili-includes\xl-class-admin.php:254
actionmanage_posts_custom_columnxili-includes\xl-class-admin.php:257
actionmanage_pages_custom_columnxili-includes\xl-class-admin.php:258
actionmanage_media_custom_columnxili-includes\xl-class-admin.php:259
actionadmin_print_styles-edit.phpxili-includes\xl-class-admin.php:261
actionadmin_print_styles-upload.phpxili-includes\xl-class-admin.php:262
filtercategory_namexili-includes\xl-class-admin.php:264
actionquick_edit_custom_boxxili-includes\xl-class-admin.php:267
actionadmin_head-edit.phpxili-includes\xl-class-admin.php:268
actionbulk_edit_custom_boxxili-includes\xl-class-admin.php:269
actionrestrict_manage_postsxili-includes\xl-class-admin.php:277
filtermanage_edit-category_columnsxili-includes\xl-class-admin.php:280
filtermanage_category_custom_columnxili-includes\xl-class-admin.php:281
filtercategory_row_actionsxili-includes\xl-class-admin.php:282
actionadmin_print_styles-edit-tags.phpxili-includes\xl-class-admin.php:284
actioncategory_edit_form_fieldsxili-includes\xl-class-admin.php:285
actioncategory_add_formxili-includes\xl-class-admin.php:287
actionadmin_menuxili-includes\xl-class-admin.php:290
actionadmin_enqueue_scriptsxili-includes\xl-class-admin.php:292
filtermanage_link-manager_columnsxili-includes\xl-class-admin.php:294
actionmanage_link_custom_columnxili-includes\xl-class-admin.php:295
actionadmin_print_styles-link.phpxili-includes\xl-class-admin.php:296
actionedit_linkxili-includes\xl-class-admin.php:299
actionadd_linkxili-includes\xl-class-admin.php:300
actionadded_user_metaxili-includes\xl-class-admin.php:304
filterwidget_update_callbackxili-includes\xl-class-admin.php:308
actionin_widget_formxili-includes\xl-class-admin.php:309
actionexport_filtersxili-includes\xl-class-admin.php:313
actioncontextual_helpxili-includes\xl-class-admin.php:315
actionxl_propagate_post_attributesxili-includes\xl-class-admin.php:395
actionxl_propagate_post_attributesxili-includes\xl-class-admin.php:398
actionadmin_bar_menuxili-includes\xl-class-admin.php:423
actionadmin_bar_menuxili-includes\xl-class-admin.php:425
actionset_current_userxili-includes\xl-class-admin.php:530
actionadmin_print_footer_scriptsxili-includes\xl-class-admin.php:1026
actionadd_meta_boxes_linkxili-includes\xl-class-admin.php:6761
actionafter_setup_themexili-language.php:451
actionafter_setup_themexili-language.php:453
actionafter_setup_themexili-language.php:456
actioninitxili-language.php:461
actioninitxili-language.php:462
actioninitxili-language.php:464
actioninitxili-language.php:465
actioninitxili-language.php:466
actioninitxili-language.php:468
actionswitch_themexili-language.php:472
filterposts_wherexili-language.php:477
filterposts_joinxili-language.php:478
filterposts_searchxili-language.php:480
actionpre_get_postsxili-language.php:481
actionwpxili-language.php:483
actionwpxili-language.php:484
actionwpxili-language.php:487
filterlocalexili-language.php:490
filterwidget_titlexili-language.php:493
filterwidget_textxili-language.php:494
filterlist_catsxili-language.php:496
filterlink_categoryxili-language.php:497
filterterm_linkxili-language.php:499
filtercategory_descriptionxili-language.php:501
filtersingle_cat_titlexili-language.php:502
filterget_the_archive_descriptionxili-language.php:503
filterbloginfoxili-language.php:507
filtergetarchives_joinxili-language.php:510
filtergetarchives_wherexili-language.php:511
filterget_archives_linkxili-language.php:512
filterwidget_archives_argsxili-language.php:513
filterwidget_archives_dropdown_argsxili-language.php:514
filteroption_sticky_postsxili-language.php:517
filteroption_page_on_frontxili-language.php:519
filterwidget_links_argsxili-language.php:522
filterget_bookmarksxili-language.php:523
actionwp_headxili-language.php:525
filterplugin_localexili-language.php:527
filteroption_page_for_postsxili-language.php:531
filterthe_categoryxili-language.php:533
filtergettextxili-language.php:534
filtergettext_with_contextxili-language.php:535
filterngettextxili-language.php:536
filterngettext_with_contextxili-language.php:537
actionxiliml_add_frontend_mofilesxili-language.php:539
filterthe_titlexili-language.php:542
filterwp_nav_menu_itemsxili-language.php:545
filterwp_nav_menu_objectsxili-language.php:550
filterwp_nav_menu_itemsxili-language.php:553
filterwalker_nav_menu_start_elxili-language.php:556
filterwp_nav_menu_argsxili-language.php:560
filterlanguage_attributesxili-language.php:564
actionwp_headxili-language.php:565
filteroption_date_formatxili-language.php:567
filtercategory_feed_linkxili-language.php:569
filtercomment_form_default_fieldsxili-language.php:573
filtercomment_form_defaultsxili-language.php:574
filterlocale_stylesheet_urixili-language.php:577
actionwidgets_initxili-language.php:581
filterwidget_display_callbackxili-language.php:583
actionxili_language_listxili-language.php:587
actionxili_post_languagexili-language.php:588
actionxiliml_the_other_postsxili-language.php:590
actionxiliml_the_categoryxili-language.php:591
filterxiliml_langinsearchformxili-language.php:592
filteroverride_load_textdomainxili-language.php:595
filtertheme_localexili-language.php:596
actionxl_propagate_post_attributesxili-language.php:599
actionwp_headxili-language.php:611
actionxili_language_widgets_headxili-language.php:613
filterquery_varsxili-language.php:809
filterterm_linkxili-language.php:2497
filterterm_linkxili-language.php:2499
filterterm_linkxili-language.php:5553
filterpage_linkxili-language.php:5908
filterget_pagesxili-language.php:6015
filterget_the_timexili-language.php:6118
filterget_the_datexili-language.php:6119
filterget_comment_datexili-language.php:6146
actionadmin_noticesxili-language.php:6179
actionadmin_noticesxili-language.php:6182
actioninitxili-language.php:6231
filteralias_rulexili-language.php:6257
actionplugins_loadedxili-language.php:6271
actionplugins_loadedxili-language.php:6272
actionadmin_initxili-language.php:6290
actionplugins_loadedxili-language.php:6298
actionplugins_loadedxili-language.php:6299
actionplugins_loadedxili-language.php:6300
actionadmin_noticesxili-language.php:6302
filterplugin_localexili-language.php:6312
actionplugins_loadedxili-language.php:6353
actionplugins_loadedxili-language.php:6355
actionadmin_menuxili-xl-bbp-addon.php:73
actionadmin_initxili-xl-bbp-addon.php:74
filterxiliml_manage_column_namexili-xl-bbp-addon.php:77
filterxiliml_language_translated_in_columnxili-xl-bbp-addon.php:78
actioninitxili-xl-bbp-addon.php:83
actionbbp_enqueue_scriptsxili-xl-bbp-addon.php:84
filterbbp_edit_topic_pre_insertxili-xl-bbp-addon.php:86
filterbbp_new_topic_pre_insertxili-xl-bbp-addon.php:87
filterbbp_edit_reply_pre_set_termsxili-xl-bbp-addon.php:89
filterbbp_new_reply_pre_set_termsxili-xl-bbp-addon.php:90
actionload_plugin_domain_for_curlang_bbpressxili-xl-bbp-addon.php:95
actionsave_postxili-xl-bbp-addon.php:98
actionparse_queryxili-xl-bbp-addon.php:99
filterbbp_login_widget_titlexili-xl-bbp-addon.php:103
filterbbp_view_widget_titlexili-xl-bbp-addon.php:104
filterbbp_forum_widget_titlexili-xl-bbp-addon.php:105
filterbbp_topic_widget_titlexili-xl-bbp-addon.php:106
filterbbp_replies_widget_titlexili-xl-bbp-addon.php:107
actioncontextual_helpxili-xl-bbp-addon.php:111
filterplugin_localexili-xl-bbp-addon.php:484
actionset_current_userxili-xl-bbp-addon.php:494
actionadmin_noticesxili-xl-bbp-addon.php:521
Maintenance & Trust

xili-language Maintenance & Trust

Maintenance Signals

WordPress version tested4.9.29
Last updatedApr 2, 2025
PHP min version7.4.2
Downloads278K

Community Trust

Rating78/100
Number of ratings14
Active installs700
Developer Profile

xili-language Developer Profile

Michel - xiligroup dev

4 plugins · 2K total installs

66
trust score
Avg Security Score
69/100
Avg Patch Time
83 days
View full developer profile
Detection Fingerprints

How We Detect xili-language

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/xili-language/js/admin-xili-language.js/wp-content/plugins/xili-language/js/findposts.js/wp-content/plugins/xili-language/js/xili-language-cookie.js/wp-content/plugins/xili-language/css/admin-xili-language.css/wp-content/plugins/xili-language/css/xili-language.css/wp-content/plugins/xili-language/css/widget-xili-language.css
Script Paths
/wp-content/plugins/xili-language/js/admin-xili-language.js/wp-content/plugins/xili-language/js/findposts.js/wp-content/plugins/xili-language/js/xili-language-cookie.js
Version Parameters
xili-language/js/admin-xili-language.js?ver=xili-language/js/findposts.js?ver=xili-language/js/xili-language-cookie.js?ver=xili-language/css/admin-xili-language.css?ver=xili-language/css/xili-language.css?ver=xili-language/css/widget-xili-language.css?ver=

HTML / DOM Fingerprints

CSS Classes
xili-language-widgetxili-language-flags
HTML Comments
<!-- XILI LANGUAGE --><!-- XILI LANGUAGE END --><!-- This is a multilingual website -->
Data Attributes
data-xl-attr-post-iddata-xl-attr-langdata-xl-attr-post-type
JS Globals
xili_language_cookie_value
REST Endpoints
/wp-json/xili-language/
Shortcode Output
[xili-language-flags][xili-language-list][xili-language-selector]
FAQ

Frequently Asked Questions about xili-language