CVE-2026-101920 in Authorship Plugin
Summary
by MITRE • 10/10/2026
The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin's author-filter rewriter never appends the ?m_bm=true marker to its own anchors (Plugin::has_pro() returns false), meaning every href the byline script selects and rewrites is fully attacker-controlled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The Molongui Authorship WordPress plugin, specifically versions up through 5.2.12, contains a critical security flaw classified as Stored DOM-Based Cross-Site Scripting. This vulnerability stems from insufficient input sanitization and output escaping within the comment handling mechanism of the application. The specific point of failure involves the href attribute located inside user-provided comment content. Because this data is stored on the server without adequate validation, it persists in the database until retrieved by a client-side script for display. When an unauthenticated attacker submits malicious JavaScript code embedded within these comments, the code remains dormant until another user views the page containing that specific comment.
The operational impact of this vulnerability is significant because it allows for persistent attacks against site visitors rather than just immediate exploitation during submission. The attack vector relies on the plugin's author-filter rewriter functionality, which dynamically modifies anchor tags to track or format author information. In the free version of the plugin, a logical flaw exists where the system fails to append the necessary ?m_bm=true marker to its own generated anchors. This omission means that every href attribute selected and rewritten by the byline script is effectively under attacker control if it originates from user input. Consequently, any malicious payload injected into these fields will be executed in the context of the victim's browser session when they access the compromised page.
From a technical classification perspective, this issue aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored nature of the XSS payload elevates the severity compared to reflected variants because it does not require social engineering tricks like phishing links; instead, the vulnerability lies in wait for any user interaction with the affected content. Furthermore, this behavior maps directly to MITRE ATT&CK technique T1059.007, JavaScript Execution via DOM-based XSS. The attacker leverages client-side scripts to execute arbitrary code within the trusted context of the WordPress site, potentially leading to session hijacking, credential theft, or defacement depending on the privileges and capabilities available in that environment.
Mitigation strategies must address both immediate remediation and long-term security hygiene. Users running affected versions should immediately update the Molongui Authorship plugin to version 5.2.13 or later where this specific logic error regarding anchor markers has been corrected. Until an update is applied, administrators can consider disabling comments on posts that utilize author boxes if feasible, though this may impact site functionality. Additionally implementing a Web Application Firewall with rules capable of detecting and blocking DOM-based XSS patterns in comment fields provides a layer of defense against exploitation attempts. Developers should also enforce strict output encoding for all dynamic content rendered via JavaScript to ensure that user-supplied data is treated as text rather than executable code, thereby neutralizing the attack vector at its source regardless of client-side processing logic.