CVE-2026-11977

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

CVE-2026-11977 WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

EUVD-2026-53288

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpmametaboxauthorslist' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack...

Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure

The plugin introduced an information disclosure vulnerability specifically, the e-mails of guest authors via a public REST endpoint accessible without any authentication PoC https://example.com/wp-json/wp/v2/coauthors...

Co-Authors-Plus 3.5/3.5.1 - Guest Authors Email Address Disclosure

The plugin introduced an information disclosure vulnerability specifically, the e-mails of guest authors via a public REST endpoint accessible without any authentication https://example.com/wp-json/wp/v2/coauthors...

WordPress Co-Authors Plus plugin <= 3.5.1 - Guest Authors Email Address Disclosure vulnerability

Guest Authors Email Address Disclosure vulnerability discovered by Douglas Johnson in WordPress Co-Authors Plus plugin versions = 3.5.1. Solution Update the WordPress Co-Authors Plus plugin to the latest available version at least 3.5.2...