Molongui Authorship Author Boxes Guest Authors Co Authors For Wordpress
Monthly
Stored DOM-based cross-site scripting in the Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress plugin (free build, versions up to and including 5.2.12) lets unauthenticated attackers inject arbitrary web scripts via the href attribute inside comment content, which then execute in the browser of any visitor who loads the affected page. The flaw is confined to the free build: because Plugin::has_pro() returns false, the author-filter rewriter never appends its ?m_bm=true marker to plugin-generated anchors, so every href the byline script selects and rewrites is fully attacker-controlled. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2 High) and no public exploit code identified at time of analysis.
Stored DOM-based cross-site scripting in the Molongui Authorship - Author Boxes, Guest Authors & Co-Authors for WordPress plugin (free build, versions up to and including 5.2.12) lets unauthenticated attackers inject arbitrary web scripts via the href attribute inside comment content, which then execute in the browser of any visitor who loads the affected page. The flaw is confined to the free build: because Plugin::has_pro() returns false, the author-filter rewriter never appends its ?m_bm=true marker to plugin-generated anchors, so every href the byline script selects and rewrites is fully attacker-controlled. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2 High) and no public exploit code identified at time of analysis.