CVE-2026-101920

Name of the Vulnerable Software and Affected Versions Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress versions prior to 5.2.13

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the comment (href attribute inside comment content) parameter. In the free version, the plugin's author-filter rewriter fails to append the ?m bm=true marker to its anchors because the has pro() function returns false, leaving the href attributes fully controlled by the attacker. This enables the injection of arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress to version 5.2.13 or later.