Content security policy issue

This thread is resolved. Here is a description of the problem and solution.

Problem:
The client reported issues with the Content Security Policy (CSP) affecting WPML, specifically involving directives like 'unsafe-inline', 'unsafe-eval', and 'https: URI' in default-src. These issues allow the execution of unsafe scripts and code. The client used a tool called Tenable Nessus to detect these issues and noticed errors such as 'Uncaught ReferenceError: wpml_cookies is not defined' from language-cookie.js.
Solution:
We asked the client to provide more details about the issues and to share the site debug information following our guide at https://wpml.org/faq/provide-debug-information-faster-support/. We also requested the URL or a screenshot of the errors and access credentials to the site for further investigation. We continued the conversation in a forum ticket to address the issue more securely.

If this solution does not resolve your issue, or if it seems outdated or irrelevant to your case, we highly recommend checking related known issues at https://wpml.org/known-issues/, verifying the version of the permanent fix, and confirming that you have installed the latest versions of themes and plugins. If the problem persists, please open a new support ticket at WPML support forum.

This is the technical support forum for WPML - the multilingual WordPress plugin.

Everyone can read, but only WPML clients can post here. WPML team is replying on the forum 6 days per week, 22 hours per day.

Tagged: Exception

This topic contains 3 replies, has 0 voices.

Last updated by Carlos Rojas 1 week, 1 day ago.

Assisted by: Carlos Rojas.

Author	Posts
January 28, 2026 at 11:24 am #17770204
Emanuela	Hello! Our client recently sent us a report regarding content security policy issues. Here you can find the details: Directive: default-src Issue 1: unsafe-inline allows the execution of unsafe in-page scripts and event handlers. Issue 2: unsafe-eval allows the execution of code injected into DOM APIs such as eval(). Issue 3: https: URI in default-src allows the execution of unsafe scripts. We noticed that the CSP policies also affects WPML. Have you already worked on these security issues? Do you have an hook we can use to set a nonce or hash to styles and scripts generated by your plugins? Thanks, Emanuela
January 28, 2026 at 12:06 pm #17770382
Carlos Rojas WPML Supporter since 03/2017 Languages: English (English ) Spanish (Español ) Timezone: Europe/Madrid (GMT+01:00)	Hi Emanuela, This is the forum ticket where we will continue working on this issue. I have set your next message private so you can securely share the access credentials to the site. Looking forward to your message. Regards, Carlos
February 2, 2026 at 9:55 am #17783071
Emanuela	hello! I still need assistance. First of all i need to backup the staging site and ask my client if I can send you the credentials you need. I'll be back to you as soon as I receive the authorization. Many thanks. E
February 2, 2026 at 12:29 pm #17783767
Carlos Rojas WPML Supporter since 03/2017 Languages: English (English ) Spanish (Español ) Timezone: Europe/Madrid (GMT+01:00)	Sure! I will be waiting for your message.