Molongui Authorship CVE-2026-101920

Exploitation requires the FREE build of the Molongui Authorship plugin (versions up to and including 5.2.12), where Plugin::has_pro() returns false so the author-filter rewriter never appends the ?m_bm=true marker to its own anchors - making every href the byline script rewrites fully attacker-controlled; the pro build is not affected by this specific path. The site must accept comment content (the 'comment' href-inside-comment-content parameter is the injection point), and comment submission must be reachable by unauthenticated users for the PR:N scenario to hold. The principal limiting factor is that payload execution is deferred and conditional on a victim loading the specific injected page (stored/DOM-based trigger), and exploitation is confined to deployments running the vulnerable free build with the byline/author-filter feature active.

The input CVSS 3.1 base score of 7.2 (High) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) stored XSS with a changed scope (S:C) and low confidentiality/integrity impact (C:L/I:L/A:N). The combination of PR:N and AC:L is the main driver of risk: an unauthenticated attacker can plant the payload via a comment, and the plugin's own byline/author-filter rewriter then rewrites the attacker-controlled href on every page view. However, no EPSS probability was supplied, the CVE is not present in CISA KEV (no active exploitation signal), and no public proof-of-concept is indicated in the provided data - so this is a high-CVSS finding without any corroborating real-world exploitation evidence at this time. One signal tension worth flagging: the vector uses UI:N, yet the description states the script executes 'whenever a user accesses an injected page,' which is a form of victim browsing - some analysts would score this UI:R, which would lower the base score. Exploitation is further gated by a specific condition (the free, non-pro build where Plugin::has_pro() returns false). Net assessment: a credible, vendor-reported (Wordfence) stored XSS that merits patching on the normal cycle, but absent EPSS/KEV/POC it is a 'patch-soon' issue rather than an emergency, and its realistic footprint is bounded by the free-build requirement and the need for a victim to load the affected page.

An unauthenticated attacker submits a blog comment on a site running the free build of Molongui Authorship, embedding a malicious href inside the comment content. Because the plugin's author-filter byline script rewrites that anchor without appending the pro-only ?m_bm=true marker, the attacker fully controls the rewritten link, and the DOM-based payload executes in the browser of any user who later views the injected page. No public exploit code is indicated in the supplied data, but exploitation is low-complexity and requires no authentication.