Afthemes
Monthly
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author allows SQL Injection.8.2. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AF themes WP Post Author allows Stored XSS.6.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in AF themes WP Post Author.6.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in AF themes WP Post Author.6.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author allows SQL Injection.8.2. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AF themes WP Post Author allows Stored XSS.6.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in AF themes WP Post Author.6.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in AF themes WP Post Author.6.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.