Wp Post Author Author Box Multiple Authors Guest Authors Custom Avatars
Monthly
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.