About Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks. PoC With a role as low as Contributor, put the following payloads in one of the Social...

WordPress About Author Box plugin <= 1.0.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Francesco Carlucci in WordPress About Author Box plugin versions = 1.0.1. Solution Update the WordPress About Author Box plugin to the latest available version at least 1.0.2...