Software intelligence

Wp Post Author vulnerabilities

9 tracked advisories · slug wp-post-author

Important: Wp Post Author appearing in this catalog does not mean your website is affected. Exposure depends on your installed version. How SiteRespond intelligence works

Tracked advisories

Latest advisory

4 August 2026

CISA KEV matches

In this WordPress feed

WordPress slug

wp-post-author

Plugin

What this means for Wp Post Author

This catalog lists 9 known advisories affecting Wp Post Author. The most recent was published on 4 August 2026. If you use this software, compare your installed version against the affected ranges on each advisory and update to a fixed release outside those ranges. SiteRespond Defence checks your actual installed version when the plugin is connected — listing here does not by itself mean your site is vulnerable.

Latest issues

WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection
May allow attackers to read or modify database contents beyond intended access.
Published 4 August 2026
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 - Authenticated (Contributor+) SQL Injection
May allow attackers to read or modify database contents beyond intended access.
Published 26 June 2026
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
May allow attackers to run scripts in visitors' browsers or hijack admin sessions.
Published 30 April 2026

Vulnerability types

SQL injection4
Cross-site scripting2
Privilege escalation1

Authentication (inferred from titles)

Unauthenticated0
Authenticated8
Unspecified1

Advisory history

Known Wp Post Author advisories published by month.

Oct 25

Nov 25

Dec 25

Jan 26

Feb 26

Mar 26

Apr 26

May 26

Jun 26

Jul 26

Aug 26

Sept 26

All advisories

WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection
CVE-2026-11977 · Published 4 August 2026
Affected versions: ≤ 3.9.1
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 - Authenticated (Contributor+) SQL Injection
CVE-2026-57643 · Published 26 June 2026
Affected versions: ≤ 3.9.1
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
CVE-2024-13362 · Published 30 April 2026
Affected versions: ≤ 3.8.3
WP Post Author <= 3.8.2 - Authenticated (Administrator+) SQL Injection
CVE-2024-56247 · Published 30 December 2024
Affected versions: ≤ 3.8.2
Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection
CVE-2024-8757 · Published 11 October 2024
Affected versions: ≤ 3.8.1
WP Post Author <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-37101 · Published 20 June 2024
Affected versions: ≤ 3.6.7
WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.6.4 - Missing Authorization to Rating Manipulation
CVE-2024-34387 · Published 6 May 2024
Affected versions: ≤ 3.6.4
WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.7.4 - Missing Authorization
CVE-2024-34389 · Published 6 May 2024
Affected versions: ≤ 3.7.4
WP Post Author <= 3.2.3 - Privilege Escalation
No CVE assigned · Published 28 June 2023
Affected versions: ≤ 3.2.3

Check whether your installed version is affected

SiteRespond Defence matches your installed Wp Post Author version against this catalog when the Defence plugin is connected to your WordPress site.

Start SiteRespond Defence for WordPress — £29.99/monthScan your website