Threat database

Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin versions up to and including 5.2.12 are vulnerable to a stored DOM-based cross-site scripting (XSS) flaw. The vulnerability arises from insufficient input sanitization and output escaping of the 'comment' parameter within the href attribute of comment content. This allows unauthenticated attackers to inject arbitrary scripts that execute when users visit affected pages. The issue affects the free version of the plugin due to the author-filter rewriter not appending a specific marker, making all href attributes attacker-controllable.