CVE-2026-101920: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in molongui Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress

CVE-2026-101920 is a stored DOM-based cross-site scripting vulnerability in the Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin. It affects all versions up to and including 5.2.12. The vulnerability is caused by improper neutralization of input in the 'comment' parameter inside the href attribute of comment content, allowing unauthenticated attackers to inject malicious scripts. The plugin's author-filter rewriter in the free build does not append the ?m_bm=true marker to its own anchors, causing all href attributes selected and rewritten by the byline script to be attacker-controlled, enabling exploitation.

An unauthenticated attacker can inject arbitrary web scripts that execute in the context of users visiting affected pages, potentially leading to information disclosure and limited integrity impact. The vulnerability does not affect availability. The CVSS 3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with scope changed.

No official patch or fix is currently documented in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the plugin or restricting access to affected pages to trusted users only. Monitor vendor channels for updates and apply official patches once released.