CVE-2021-39349

Name of the Vulnerable Software and Affected Versions: Author Bio Box WordPress plugin versions up to and including 3.3.1 HAL WordPress plugin versions up to and including 2.1.1

Description: The issue is related to Stored Cross-Site Scripting due to insufficient input validation and sanitization. This allows attackers with administrative user access to inject arbitrary web scripts. The vulnerability affects multi-site installations where unfiltered html is disabled for administrators, and sites where unfiltered html is disabled.

Recommendations: For Author Bio Box WordPress plugin versions up to and including 3.3.1, update to a version later than 3.3.1 to resolve the issue. For HAL WordPress plugin versions up to and including 2.1.1, update to a version later than 2.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the ~/includes/admin/class-author-bio-box-admin.php and ~/wp-hal.php files to minimize the risk of exploitation. Restrict the use of unfiltered html for administrators in multi-site installations to reduce the risk of Stored Cross-Site Scripting attacks.