TI-2026-70225 Aliases CVE-2026-101920 GHSA-m398-mh86-wgcp

Molongui Authorship Stored DOM-Based XSS via Comment href Attribute

LOW 31CWE-79Published 2026-10-10 · Updated 2026-10-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Molongui Authorship plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (CWE-79) via the comment href attribute in all versions up to and including 5.2.12, due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages, which execute whenever a user accesses an injected page. The free build is exploitable because the author-filter rewriter never appends the ?m_bm=true marker to its own anchors, since Plugin::has_pro() returns false, so every href the byline script selects and rewrites is attacker-controlled. CVSS 3.1 base score is 7.2 (HIGH), and CISA has not added it to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin's author-filter rewriter never appends the ?m_bm=true marker to its own anchors (Plugin::has_pro() returns false), meaning every href the byline script selects and rewrites is fully attacker-controlled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00297 22nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Molongui	Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress	up to 5.2.12	—	No fix listed	CNA

Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress VendorMolongui Affected up to 5.2.12 Fixed in — No fix listed CNA

Remediation

No fixed version is listed, so there is no vendor patch to apply. Disable or remove the Molongui Authorship plugin until a version later than 5.2.12 is released, and check the vendor for updates.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-10 Threatist record created from CVE-2026-101920
2026-10-10 Alias added: GHSA-m398-mh86-wgcp
2026-10-11 CISA SSVC decision points changed
2026-10-11 Priority changed: MEDIUM → LOW

References

Other 5

TI-2023-06411 Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug CVSS 3.1HIGH 7.5
TI-2023-20330 WordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
TI-2024-19540 WordPress Molongui plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
TI-2023-20820 WordPress Molongui Plugin <= 4.6.19 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9
TI-2023-27780 WordPress Molongui plugin <= 4.7.3 - Broken Access Control vulnerability CVSS 3.1MEDIUM 4.3
TI-2024-20231 WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences