Description Improper validation leads to a generic XSS vector in the language override feature. Remediation References CVE-2026-48954 Related Vulnerabilities Chamilo Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-29041) WordPress Plugin Backup, Restore and Migrate WordPress Sites With the XCloner Security Bypass (4.2.12) WordPress Plugin CoolClock-a Javascript Analog Clock Cross-Site Scripting (4.3.4) MediaWiki Improper Authentication Vulnerability (CVE-2021-30158) Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-26530) Severity Medium Classification CVE-2026-48954 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Tags Missing Update Known Vulnerabilities