afthemes vulnerabilities

Products

• wp post author 5
• WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars 3

Latest afthemes CVEs

Newest publication first

1. CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

   Published 2026-08-05

   Medium·CVSS 6.5 EPSS 0.41%

   The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplie...

2. CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

   Published 2026-05-01

   Medium·CVSS 6.1 EPSS 0.28%

   Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

3. CVE-2024-56247 WordPress WP Post Author plugin <= 3.8.2 - SQL Injection vulnerability

   Published 2025-01-02

   High·CVSS 7.2 EPSS 0.49%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows SQL Injection.This issue affects WP Post Author: from n/a through <= 3.8.2.

4. CVE-2024-8757 Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection

   Published 2024-10-12

   High·CVSS 7.2 EPSS 0.51%

   The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_user_id parameter in all version...

5. CVE-2024-37101 WordPress WP Post Author plugin <= 3.6.7 - Cross Site Scripting (XSS) vulnerability

   Published 2024-07-22

   Medium·CVSS 5.4 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AF themes WP Post Author allows Stored XSS.This issue affects WP Post Author: from n/a through 3.6.7.

6. CVE-2024-34387 WordPress WP Post Author plugin <= 3.6.4 - Rating Value Manipulation vulnerability

   Published 2024-05-06

   Medium·CVSS 4.3 EPSS 0.36%

   Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.

7. CVE-2024-34389 WordPress WP Post Author plugin <= 3.6.4 - Broken Access Control vulnerability

   Published 2024-05-06

   Medium·CVSS 4.3 EPSS 0.36%

   Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.